Code injection in Apache Struts through Dynamic Method Invocation
Priority CRITICAL 94Exploited in the wildCWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
Apache Struts struts2-core versions from 2.3.19 before 2.3.20.3, from 2.3.21 before 2.3.24.3, and from 2.3.25 before 2.3.28.1 are affected when Dynamic Method Invocation is enabled. The flaw is an injection issue (CWE-77) in how chained expressions handle the method: prefix. An unauthenticated remote attacker can execute arbitrary code on the server. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-08, and a public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Why it matters now
Exploitation Active In CISA KEV since 2026-10-08CISA due date 2026-10-11
EPSS 0.96525 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed org.apache.struts:struts2-core (Maven): 2.3.20.3, 2.3.24.3, 2.3.28.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.struts:struts2-core (Maven) | 2.3.19 to before 2.3.20.3 | 2.3.20.3 | Patch available | GHSA-8c6j-ffmf-q6vm |
| — | org.apache.struts:struts2-core (Maven) | 2.3.21 to before 2.3.24.3 | 2.3.24.3 | Patch available | GHSA-8c6j-ffmf-q6vm |
| — | org.apache.struts:struts2-core (Maven) | 2.3.25 to before 2.3.28.1 | 2.3.28.1 | Patch available | GHSA-8c6j-ffmf-q6vm |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.struts:struts2-core (Maven) Vendor— Affected 2.3.19 to before 2.3.20.3 Fixed in 2.3.20.3 Patch available GHSA-8c6j-ffmf-q6vm
- org.apache.struts:struts2-core (Maven) Vendor— Affected 2.3.21 to before 2.3.24.3 Fixed in 2.3.24.3 Patch available GHSA-8c6j-ffmf-q6vm
- org.apache.struts:struts2-core (Maven) Vendor— Affected 2.3.25 to before 2.3.28.1 Fixed in 2.3.28.1 Patch available GHSA-8c6j-ffmf-q6vm
CPE configurations NVD · 78
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c00:*:*:*:*:*:*:* | v100r002c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:agile_controller-campus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:a:huawei:anyoffice:v200r005c00:*:*:*:*:*:*:* | v200r005c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:anyoffice:v200r006c00:*:*:*:*:*:*:* | v200r006c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:logcenter:v100r001c10:*:*:*:*:*:*:* | v100r001c10 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:logcenter:v100r001c20:*:*:*:*:*:*:* | v100r001c20 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:firehunter6000_firmware:v100r001c20:*:*:*:*:*:*:* | v100r001c20 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:firehunter6000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
- cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c00:*:*:*:*:*:*:* Versions v100r002c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:agile_controller-campus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:a:huawei:anyoffice:v200r005c00:*:*:*:*:*:*:* Versions v200r005c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:anyoffice:v200r006c00:*:*:*:*:*:*:* Versions v200r006c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:logcenter:v100r001c10:*:*:*:*:*:*:* Versions v100r001c10 Vulnerable ·Huawei
- cpe:2.3:a:huawei:logcenter:v100r001c20:*:*:*:*:*:*:* Versions v100r001c20 Vulnerable ·Huawei
- cpe:2.3:o:huawei:firehunter6000_firmware:v100r001c20:*:*:*:*:*:*:* Versions v100r001c20 Vulnerable ·Huawei
- cpe:2.3:h:huawei:firehunter6000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
Show 68 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_5300_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_5500_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_5600_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_5800_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_6800_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_18500_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_18500f:v3:*:*:*:*:*:*:* | v3 | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_18800_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r001:*:*:*:*:*:*:* | v300r001 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r002:*:*:*:*:*:*:* | v300r002 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r003c00:*:*:*:*:*:*:* | v300r003c00 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r003c10:*:*:*:*:*:*:* | v300r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_18800f:v3:*:*:*:*:*:*:* | v3 | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_9000_firmware:v100r001c01:*:*:*:*:*:*:* | v100r001c01 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_9000_firmware:v100r001c30:*:*:*:*:*:*:* | v100r001c30 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r005c00:*:*:*:*:*:*:* | v300r005c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_9000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c09spc505:*:*:*:*:*:*:* | v200r001c09spc505 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc205:*:*:*:*:*:*:* | v200r001c91spc205 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc900:*:*:*:*:*:*:* | v200r001c91spc900 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc901:*:*:*:*:*:*:* | v200r001c91spc901 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_n8500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:oceanstor_onebox_firmware:v100r003c10:*:*:*:*:*:*:* | v100r003c10 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:oceanstor_onebox:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* | 2.3.20 to before 2.3.20.3; 2.3.21 to before 2.3.24.3; 2.3.25 to before 2.3.28.1 | Vulnerable | Apache |
| cpe:2.3:a:oracle:flexcube_private_banking:2.0.0.0:*:*:*:*:*:*:* | 2.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:* | 12.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.3:*:*:*:*:*:*:* | 12.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:* | 10.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:* | 10.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:* | 10.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.0:*:*:*:*:*:*:* | 10.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:* | 10.8.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:* | 10.8.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:siebel_e-billing:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Oracle |
- cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_5300_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_5500_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_5600_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_5800_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_6800_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_18500_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_18500f:v3:*:*:*:*:*:*:* Versions v3 Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_18800_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r001:*:*:*:*:*:*:* Versions v300r001 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r002:*:*:*:*:*:*:* Versions v300r002 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r003c00:*:*:*:*:*:*:* Versions v300r003c00 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r003c10:*:*:*:*:*:*:* Versions v300r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_18800f:v3:*:*:*:*:*:*:* Versions v3 Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_9000_firmware:v100r001c01:*:*:*:*:*:*:* Versions v100r001c01 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_9000_firmware:v100r001c30:*:*:*:*:*:*:* Versions v100r001c30 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r005c00:*:*:*:*:*:*:* Versions v300r005c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c09spc505:*:*:*:*:*:*:* Versions v200r001c09spc505 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc205:*:*:*:*:*:*:* Versions v200r001c91spc205 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc900:*:*:*:*:*:*:* Versions v200r001c91spc900 Vulnerable ·Huawei
- cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc901:*:*:*:*:*:*:* Versions v200r001c91spc901 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_n8500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:oceanstor_onebox_firmware:v100r003c10:*:*:*:*:*:*:* Versions v100r003c10 Vulnerable ·Huawei
- cpe:2.3:h:huawei:oceanstor_onebox:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions 2.3.20 to before 2.3.20.3; 2.3.21 to before 2.3.24.3; 2.3.25 to before 2.3.28.1 Vulnerable ·Apache
- cpe:2.3:a:oracle:flexcube_private_banking:2.0.0.0:*:*:*:*:*:*:* Versions 2.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:* Versions 12.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.3:*:*:*:*:*:*:* Versions 12.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.0:*:*:*:*:*:*:* Versions 10.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:* Versions 10.8.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:* Versions 10.8.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:siebel_e-billing:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
Remediation
Upgrade struts2-core to 2.3.20.3, 2.3.24.3 or 2.3.28.1, depending on the release line in use. The sources list no fixed version for the affected entry without a product name. CISA requires U.S. federal agencies to fix it by 2026-10-11.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · GHSA-8c6j-ffmf-q6vm org.apache.struts:struts2-core (Maven) Fixed in 2.3.20.3 Advisory →
- Fix · GHSA-8c6j-ffmf-q6vm org.apache.struts:struts2-core (Maven) Fixed in 2.3.24.3 Advisory →
- Fix · GHSA-8c6j-ffmf-q6vm org.apache.struts:struts2-core (Maven) Fixed in 2.3.28.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-3081
- 2026-10-03 Alias added: GHSA-8c6j-ffmf-q6vm
- 2026-10-08 Added to CISA KEV
- 2026-10-08 CVSS score added · CISA ADP
- 2026-10-08 Weakness changed · CISA ADP
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-08 Priority changed: HIGH → CRITICAL
- 2026-10-09 CISA SSVC decision points changed
- 2026-10-09 CVSS score changed · NVD
References
Exploit 2
Patch 2
Advisory 3
Other 5
- https://github.com/apache/struts
- https://web.archive.org/web/20210123152457/http://www.securityfocus.com/bid/91787
- https://web.archive.org/web/20210225192113/http://www.securityfocus.com/bid/87327
- https://web.archive.org/web/20210226011418/http://www.securitytracker.com/id/1035665
- https://www.exploit-db.com/exploits/39756
More Apache Struts vulnerabilities
- TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
- TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
Sources
- CVE-2016-3081 · CVE Program
- CVE-2016-3081 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-8c6j-ffmf-q6vm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences