CVE-2016-3081: Apache Struts Command Injection Vulnerability

According to The Hacker News, the list includes "CVE-2016-3081 (CVSS score: 8.1) - A command injection vulnerability"[1] in Apache Struts. CVE Security reports that CISA names this vulnerability "Apache Struts Command Injection Vulnerability"[2].Rapid7's vulnerability database says that Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code[3].CISA's KEV catalog lists the entry with a Date Added: 2026-10-08[4]. The Hacker News reports that federal agencies are required to apply the necessary patches or discontinue their use by October 11, 2026.[1]CISA's Acting Executive Assistant Director for Cybersecurity Chris Butera said that "Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems"[1], according to The Hacker News.Exploit-Intel reports that a Metasploit module for Apache Struts Dynamic Method Invocation remote code execution (CVE-2016-3081)[5] is publicly available. Strix says that EPSS estimates a 93.35% chance of exploitation in the next 30 days.[6]DailyCVE lists version 2.3.28.1[7] as an updated struts2-core dependency. RedPacket Security advises that if patching is delayed, disable Dynamic Method Invocation where feasible and restrict access to the application.[8]