{"id":"CVE-2016-3081","url":"https://compromised.live/t/CVE-2016-3081","kind":"exploited_vuln","tier":2,"severity":"high","title":"Apache Struts: Apache Struts Command Injection Vulnerability","summary":"Remote attackers can run their own commands on servers through a crafted method: prefix when Dynamic Method Invocation is enabled, and this flaw is being actively exploited. Apache Struts, Maven org.apache.struts:struts2-core versions 2.3.20 through 2.3.28. Upgrade to fixed versions 2.3.20.3, 2.3.24.3, or 2.3.28.1 now, and check for signs of compromise.","summary_source":"ai","affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","affected":"2.3.20, 2.3.20.1, 2.3.24, 2.3.24.1, 2.3.28","fixed":["2.3.20.3","2.3.24.3","2.3.28.1"]}],"epss":null,"kev":{"date_added":"2026-10-08","due_date":"2026-10-11","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z","status":"active","details":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","aliases":["CVE-2016-3081","GHSA-8c6j-ffmf-q6vm"],"sources":[{"name":"kev","id":"CVE-2016-3081","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3081"}]}