CVE-2016-3081: Apache Struts Command Injection Vulnerability

According to CVE Security, CVE-2016-3081 is a remote code execution vulnerability in Apache Struts versions 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28.[1] The site says CISA calls it an "Apache Struts Command Injection Vulnerability"[1].The Hacker News reports that the Struts flaw works only when Dynamic Method Invocation is turned on, and Apache says turning it off is an alternative to upgrading.[2]CVE Security lists the CISA remediation deadline for federal agencies[1] as October 11, 2026, and says the KEV entry has a forensic triage flag[1].CISA's advisory says Integrity Technology Group is a China-based for-profit company with links to the Chinese government.[3] The advisory says its MicroScan scripts were used to target services including OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.[3]The Hacker News reports that the advisory lists 8 known flaws that it says were successfully exploited.[2] It adds that the advisory marks 5 of the 8 with an asterisk and describes them as newly added to the Known Exploited Vulnerabilities (KEV) catalog[2]. BleepingComputer lists CVE-2016-3081: Apache Struts remote code execution vulnerability[4] among them.BleepingComputer reports that the FBI seized the c0cc.cc domain used by Integrity Tech to access the MicroScan platform[4].HeroDevs advises users to move to secure versions (Apache Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1).[5]