CVE-2016-3081: Apache Struts Command Injection Vulnerability

Cybersecurity News says the bug is a command injection vulnerability in Apache Struts that can allow a remote attacker to run code on a vulnerable server when Dynamic Method Invocation is enabled.[1]According to the same outlet, CISA added the vulnerability on October 8, 2026, and gave U.S. federal civilian agencies until October 11 to address it under Binding Operational Directive 26-04.[1] It adds that the agency also marked the flaw as requiring forensic triage, meaning affected organizations should not treat patching as the only task.[1]xHack notes that the catalog does not say why it was added now.[2] GBHackers reports that CISA's KEV listing does not indicate any known ransomware use associated with CVE-2016-3081[3].GBHackers calls the flaw "critical"[3]. Senserva, however, lists it as High severity, CVSS v3 8.1[4].The Rapid7 vulnerability database says affected versions are Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28[5]. xHack reports that Apache and NVD disagree on the affected range[2].For fixes, xHack advises users to upgrade to 2.3.20.3, 2.3.24.3 or 2.3.28.1, or turn Dynamic Method Invocation off.[2] It also warns that public exploit code exists.[2] Exploit-Intel lists a Metasploit module for Apache Struts Dynamic Method Invocation remote code execution (CVE-2016-3081).[6]