Apache Struts CVE-2016-3081: command injection under attack

What it is and who is affectedCVE-2016-3081 is a command injection flaw in Apache Struts, catalogued by NIST as CWE-77. According to the National Vuln...

What it is and who is affected

CVE-2016-3081 is a command injection flaw in Apache Struts, catalogued by NIST as CWE-77. According to the National Vulnerability Database (NVD), when Dynamic Method Invocation is enabled, a remote attacker can execute arbitrary code through a method: prefix in a chained expression. The vulnerability was published in the NVD on 26 April 2016 and carries a CVSS 3.1 score of 8.1 (HIGH), with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

The affected Apache Struts ranges, as listed by the NVD, are 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28. The same record also maps the flaw to a long list of third-party products that bundle the framework, including Huawei Agile Controller-Campus, AnyOffice, LogCenter, FireHunter6000 and several OceanStor 5300 V3 and 5500 V3 firmware releases, among more than sixty configurations in total.

In practice, this matters to any Spanish SME, online shop or small IT team that runs a Java-based application behind a WordPress, PrestaShop or Joomla front end, or that inherited an internal tool built years ago on an old Struts release. The framework is often buried in a legacy module that nobody reviews, which is exactly where outdated versions survive.

Why it is urgent

The CISA Known Exploited Vulnerabilities (KEV) catalogue states that CVE-2016-3081 is exploited in the wild. CISA added it to the catalogue on 8 October 2026 and gave US federal agencies until 11 October 2026 to apply mitigations in line with vendor instructions, following its BOD 26-04 guidance on prioritising security updates by risk, and its forensics triage requirements. The material does not record known use in ransomware campaigns, but that does not lower the priority: a flaw that grants remote code execution on a public-facing service is the kind of entry point that turns into a full server compromise.

A decade-old CVE resurfacing in the KEV catalogue is a reminder that attackers keep recycling exploits for systems that were never patched. For a business in Lleida, Barcelona, Tarragona or Girona, the exposure is the same as anywhere else: if the endpoint answers from the internet, it is reachable.

What to do today

Inventory first. Check whether any application, plugin, internal portal or third-party appliance in your estate runs Apache Struts, and confirm the exact version against the ranges above.
Apply the vendor fix. Follow the Apache Struts security advisory S2-032 and the vendor advisory for the affected product. If the material you have does not state a corrected version for your specific bundle, apply whatever the manufacturer's advisory indicates rather than guessing.
Disable Dynamic Method Invocation where the application does not strictly need it, as the flaw only applies when that feature is enabled.
Look for signs of intrusion. Review web server and application logs for unusual requests containing a method: prefix, unexpected outbound connections, new files in deployable directories and accounts or processes you cannot explain.
Reduce internet exposure. Put legacy Java applications behind a reverse proxy or VPN, restrict access by IP where possible, and make sure a small IT team is not the only line of defence.

How a cybersecurity team like ALMC can help

Finding a Struts library hidden inside an old application is rarely something a two-person IT department has time for. At ALMC we work with SMEs and online shops across Catalonia on exactly this: security audits and pentesting to surface unpatched components before someone else finds them, hardening of servers and CMS platforms such as WordPress, PrestaShop and Joomla, continuous monitoring and incident response, and recovery when a site has already been hacked.

It is not only about applying one patch. It is about knowing what you have, keeping it updated, and having someone who reacts when a CVE like this one reappears in the news. If your team is small, that external pair of eyes is often the difference between a quiet Tuesday and a very long week.

Sources: CISA Known Exploited Vulnerabilities catalogue and the NIST National Vulnerability Database.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.