Apache Struts 2 RCE exploited in the wild (CVE-2016-3081)

Actively exploited in the wild - CVE-2016-3081 is a critical remote code execution flaw in Apache Struts 2.3.19 through 2.3.28 that lets unauthenticated attackers run arbitrary commands on the server when Dynamic Method Invocation is enabled. Upgrade to Struts 2.3.29 or later, or disable DMI immediately.

Overview

Apache Struts is a popular Java framework for building web applications. CVE-2016-3081 abuses a feature called Dynamic Method Invocation (DMI), which allows the method: prefix in URLs to call server-side methods directly. When DMI is enabled, a remote attacker can craft a request that chains expressions together and executes arbitrary code on the underlying server.

The vulnerability affects Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28. Older branches and 2.3.29 and later are not affected by this specific issue. CISA added it to the Known Exploited Vulnerabilities catalog, confirming real-world attacks against unpatched systems.

Impact

Successful exploitation grants the attacker the same privileges as the application server process. That usually means the ability to read configuration files and database credentials, modify application data, install web shells, and pivot laterally into the internal network. Because no authentication or user interaction is required, any internet-facing Struts application with DMI enabled is directly exposed. The CVSS score of 9.3 reflects the severe confidentiality, integrity, and availability impact.

This class of Struts flaw has been repeatedly targeted at scale. Automated scanners still sweep for the method: pattern years after disclosure, so exposure does not require a targeted attacker.

Remediation and Mitigation

• Upgrade Apache Struts to 2.3.29 or later, which removes the vulnerable chained-expression handling.
• If you cannot patch immediately, disable Dynamic Method Invocation by setting struts.enable.DynamicMethodInvocation to false in your struts.xml and redeploy.
• Block requests containing the method: prefix at your WAF or reverse proxy as a temporary control.
• Restrict outbound network access from application servers to limit post-exploitation movement.
• Rotate any credentials stored in application configuration files, since exploitation may have already occurred.

Verify your Struts version with the struts2-core JAR in your deployment, not the version listed in your build file, because transitive dependencies often drift.

Security Insight

The Struts DMI flaw is a textbook case of a convenience feature becoming an attack surface: the same flexibility that let developers call methods from URLs also let attackers call whatever they wanted. It also previews the pattern that made the later Struts OGNL vulnerabilities so damaging, where years-old framework code kept resurfacing in breach reports long after patches existed. For defenders, the lesson is that framework-level features are rarely retired on their own, and inventorying Java dependencies remains the only reliable way to know if you are exposed. Teams tracking active framework abuse should also review Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo for a current example of the same exploitation dynamic.

Further Reading

• Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs