WATCHExploited vulnerability
Maven / org.apache.struts:struts2-core
Apache Struts Command Injection Vulnerability
What's happening and what to do
Remote attackers can run their own commands on servers through a crafted method: prefix when Dynamic Method Invocation is enabled, and this flaw is being actively exploited. Apache Struts, Maven org.apache.struts:struts2-core versions 2.3.20 through 2.3.28. Upgrade to fixed versions 2.3.20.3, 2.3.24.3, or 2.3.28.1 now, and check for signs of compromise.
AI summary of the sources on this page. Regenerated when a source changes.
Affected versions
| Ecosystem | Package | Affected | Safe from |
|---|---|---|---|
| Maven | org.apache.struts:struts2-core | 2.3.20, 2.3.20.1, 2.3.24, 2.3.24.1, 2.3.28 | 2.3.20.3, 2.3.24.3, 2.3.28.1 |
Signals over time
- 2026-10-08Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-10-11Federal patch deadline for US agencies.
- 2026-11-03 21:55First seen here.
Source text
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.