CVE-2016-3081: Apache Struts Dynamic Method Invocation Remote Code Execution (CISA KEV)

What Is the Flaw?

CVE-2016-3081 is a command injection vulnerability (classified under CWE-77: Improper Neutralization of Special Elements used in a Command) in the Apache Struts framework. When Dynamic Method Invocation (DMI) is enabled, the framework fails to properly sanitize user-supplied input that uses the method: prefix in action URLs.

An attacker who crafts a request using the method: prefix can supply chained OGNL (Object-Graph Navigation Language) expressions that the framework evaluates on the server side, ultimately resulting in the execution of arbitrary operating-system commands or Java code without any authentication requirement.

The vulnerability was published on 2016-04-26 and carries a CVSS 3.1 score of 8.1 (HIGH) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The High attack complexity rating reflects the fact that exploitation requires DMI to be explicitly enabled, which is not the default in all configurations but was common in many real-world deployments.

Who and What Is Affected?

The following Apache Struts 2 version ranges are confirmed vulnerable according to the NVD advisory:

• 2.3.19 through 2.3.20.2
• 2.3.21 through 2.3.24.1
• 2.3.25 through 2.3.28

Affected deployments share one critical prerequisite: Dynamic Method Invocation must be enabled in the Struts configuration (struts.enable.DynamicMethodInvocation = true). Organizations that explicitly or inadvertently left DMI active in any of the above versions are exposed.

Apache Struts is widely used in enterprise Java web applications, government portals, financial platforms, and internal business tools. Any internet-facing or internally accessible application built on the affected versions warrants immediate review.

Potential Impact

Successful exploitation of CVE-2016-3081 can give a remote, unauthenticated attacker full control over the affected server process. The CVSS score reflects high impact across all three security pillars:

• Confidentiality (High): Attackers can read sensitive application data, credentials, configuration files, and anything accessible to the web server process.
• Integrity (High): Arbitrary files can be written, modified, or deleted. Web shells and backdoors can be planted.
• Availability (High): The server process can be crashed, services disrupted, or systems rendered inoperable.

Because no authentication or user interaction is needed, the attack surface is the entire internet if the application is externally reachable. Even internally exposed applications are at risk if an attacker gains a foothold on the network.

Critically, this vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-10-08, confirming that exploitation is an active, real-world concern requiring prioritized remediation under CISA's Binding Operational Directive 26-04.

What to Do Right Now

The following remediation steps are grounded in vendor and CISA guidance:

1. Upgrade Apache Struts immediately. Move all applications off the affected version ranges (2.3.19–2.3.28). Apply the latest stable version available from the Apache Struts project and review the vendor's own security advisories for specific remediation versions.
2. Disable Dynamic Method Invocation. If your application does not require DMI, set struts.enable.DynamicMethodInvocation = false in your Struts configuration. This eliminates the attack surface even on affected versions during transition periods, though it is not a substitute for patching.
3. Audit your application inventory. Enumerate all internal and external applications that use Struts 2 and verify their version and DMI configuration. Shadow deployments and forgotten legacy applications are common blind spots.
4. Apply CISA BOD 26-04 requirements. Federal and applicable organizations must follow the patching timelines and forensic triage requirements outlined in CISA's Binding Operational Directive 26-04. CISA's KEV required action explicitly references these obligations. If mitigations cannot be applied, CISA advises considering discontinuation of the affected product.
5. Review for indicators of compromise. Given that this CVE is in the CISA KEV catalog, treat any unpatched or previously unpatched instance as potentially compromised. Review access logs for unusual method: prefixed requests and anomalous process execution from the web server user.
6. Consult primary sources: NVD — CVE-2016-3081 and the CISA KEV Catalog.

How Continuous External Testing Surfaces This Exposure

One of the persistent challenges with long-standing vulnerabilities like CVE-2016-3081 is that they often survive patching cycles in forgotten or shadow applications — instances that IT and security teams may not know are still running and internet-exposed. A one-time penetration test or annual scan provides only a point-in-time snapshot.

Continuous external attack surface monitoring and testing addresses this by routinely probing your internet-facing perimeter, including:

• Detecting newly exposed or rediscovered hosts running vulnerable versions of Apache Struts.
• Identifying misconfigurations such as DMI being re-enabled after a configuration change or deployment rollback.
• Flagging Struts-based endpoints that emerge after application updates, containerization, or infrastructure changes.
• Correlating discovered assets against known vulnerable version ranges in real time, not on a quarterly schedule.

When a vulnerability with a known exploitation history (as evidenced by CISA KEV inclusion) exists in widely deployed middleware, the window between exposure and exploitation can be short. Continuous testing ensures that your team is alerted to exposure before an adversary acts on it, rather than discovering the exposure during incident response.

Frequently asked questions

Does Dynamic Method Invocation have to be enabled for CVE-2016-3081 to be exploitable?

Yes. According to the NVD advisory, the vulnerability is only exploitable when Dynamic Method Invocation (DMI) is enabled in the Struts configuration. If DMI is disabled, the specific attack vector using the method: prefix is not available. However, disabling DMI should be treated as a mitigation measure, not a permanent substitute for upgrading to an unaffected version.

Why is a 2016 vulnerability appearing in CISA KEV in 2026?

CISA adds vulnerabilities to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation, regardless of when the CVE was originally published. CVE-2016-3081 was added to the KEV catalog on 2026-10-08, indicating that exploitation activity justifying its inclusion was identified at that time. Legacy and long-unpatched applications are a common source of ongoing exposure for older flaws.

What is the CVSS score and what does it mean for my patching priority?

CVE-2016-3081 carries a CVSS 3.1 score of 8.1, rated HIGH. The attack vector is network-based, requires no privileges, and needs no user interaction — meaning any internet-accessible affected application is at risk from any attacker globally. Its High attack complexity reflects the DMI prerequisite. Combined with its CISA KEV status, this vulnerability should be treated as high priority for immediate remediation.

Are cloud-hosted applications subject to BOD 26-04 remediation requirements?

CISA's required action for CVE-2016-3081 explicitly references BOD 26-04 guidance for cloud services as well as on-premises deployments. Organizations should review the specific BOD 26-04 guidance applicable to their environment. If mitigations cannot be applied to a cloud-hosted instance, CISA advises considering discontinuation of the affected product.