CVE-2016-3081: Apache Struts Command Injection Vulnerability

BigGo Finance reports that the flaws affect ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND.[2] According to BigGo, the Struts flaw carries a score of 8.1. It is a command injection vulnerability that allows remote code execution via the method:prefix technique when Dynamic Method Invocation is enabled.[2]The Hacker News reports that Apache says turning it off is an alternative to upgrading.[3] The outlet also says that federal agencies are required to apply the necessary patches or discontinue their use by October 11, 2026.[1]WindowsForum, summarising BleepingComputer's account of a joint FBI, CISA and NSA advisory, reports that a scanner called MicroScan is a Python-based scanner with more than 1,300 scripts. They target software such as Oracle WebLogic, Apache Struts, WordPress and Jenkins.[4]BigGo says the KEV update coincides with a seven-nation advisory and an FBI announcement that it seized seven domains linked to hacking tools developed by Beijing-based Integrity Technology Group[2].According to The Hacker News, Acting Executive Assistant Director for Cybersecurity Chris Butera said Chinese government-affiliated actors aim at "disrupting critical functions at a future time of their choosing"[1].The Hacker News, citing the Associated Press, reports that Integrity Technology Group rejected the U.S. accusations in January 2025.[3]