Apache Struts CVE-2016-3081: DMI code execution added to KEV

On 8 October 2026 CISA added CVE-2016-3081 to its Known Exploited Vulnerabilities (KEV) catalog. It is a vulnerability in Apache Struts 2, the Java framework for web applications. When Dynamic Method Invocation (DMI) is enabled, a remote, unauthenticated attacker can execute arbitrary code on the server through the method: prefix in requests.

The vulnerability is not new: it was published in April 2016. The KEV catalog, however, lists vulnerabilities for which CISA has evidence of active exploitation. Its inclusion is therefore a concrete warning for anyone still running Struts applications that have never been updated.

What happened

CISA added CVE-2016-3081 to the KEV as “Apache Struts Command Injection Vulnerability” and set 11 October 2026 as the deadline for US federal agencies: three days, a very short window. In the catalog, use in ransomware campaigns is marked as “unknown”.

The advisory asks organisations to apply mitigations according to the vendor’s instructions, in line with directive BOD 26-04 on prioritising updates based on risk and with CISA’s forensic triage requirements. If mitigations are not available, the product should be discontinued. The advisory also asks for an assessment of each system’s internet exposure.

CISA gives no details about the attacks observed, the attackers or the victims.

Technical details

• CVE: CVE-2016-3081, published on 26 April 2016. The NVD entry was updated on 9 October 2026.
• Affected versions, according to the description: Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28, only when Dynamic Method Invocation is enabled.
• CPE configurations: the list in the NVD entry instead covers versions in the 2.0, 2.1, 2.2 and 2.3 branches, from 2.0.0 to 2.3.14. The two do not match: it is wise to treat any Struts 2 release from that period as at risk until the vendor bulletin says otherwise.
• Vector: network, through HTTP requests that use the method: prefix, related to chained expressions. The result is code execution with the privileges of the web application.
• Severity: CVSS 3.1 8.1 (high), AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack is carried out over the network, needs no privileges or user interaction and affects confidentiality, integrity and availability; attack complexity is rated high. CVSS 2: 9.3 (high).
• Weakness: CWE-77 (command injection).
• Vendor bulletin: the NVD entry points to Apache Struts bulletin S2-032, tagged as vendor advisory and patch.
• Public code: the NVD references include a Packet Storm page titled “Apache Struts 2.3.28 Dynamic Method Invocation Remote Code Execution”, an Exploit-DB entry and two exploit modules catalogued by Rapid7 (struts_dmi_exec).
• Third-party products: the NVD entry also lists advisories from Oracle (Critical Patch Updates of July and October 2016) and Huawei. Struts is therefore also embedded in other vendors’ products, which have released their own fixes.
• MITRE ATT&CK: T1190 (Exploit Public-Facing Application).

Impact for European and Italian companies

For years Struts 2 was a common choice for Java web applications: portals, business applications and custom-built internal services. Many of these applications stay in production for a long time, often with the libraries they shipped with. The framework can also be embedded in third-party products without this being obvious, as the Oracle and Huawei advisories show.

Code execution on the application server is a complete foothold: from there an attacker can read the data handled by the application and the database credentials, and move towards the rest of the network.

For NIS2 entities, vulnerability management and application security are among the measures required by the directive. A compromise that starts from an exposed application may become an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN.

What to do now

1. Take inventory: identify the Java web applications that include Struts 2, including custom-built ones, those supplied by vendors and third-party products. Look for Struts libraries in the application archives deployed on your servers.
2. Check versions and configuration: according to the description, the affected installations are those in the listed versions with Dynamic Method Invocation enabled. Check the configuration of each application and keep the discrepancy with the CPE list in mind.
3. Update or mitigate: apply the fixes and guidance in Apache Struts bulletin S2-032. If you still find Struts branches from that period, consider moving to a version the vendor still supports.
4. For third-party products, follow the vendor’s bulletin. If no fix exists, CISA says to discontinue the product.
5. Reduce exposure: check which Struts applications are reachable from the internet and whether that is really necessary.
6. Detect: search web server and application logs for requests with parameters starting with method:. For applications that were exposed and vulnerable, start a forensic triage of the server, as CISA requests.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package and highlights those already exploited by attackers, such as the CVEs in the KEV catalog. ARX Expose checks the services your company exposes on the internet and the known vulnerabilities of recognised products. ARX Sentry collects logs and events from servers, and ARX Trace supports triage with artifact collections and file changes on suspicious machines.

Last updated: 8 October 2026