CISA Adds Apache Struts Command Injection Vulnerability to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2016-3081, a command injection vulnerability in Apache Struts, to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026. This designation mandates that federal civil executive branch agencies take immediate action to mitigate the risk.

The vulnerability affects Apache Struts versions 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28. According to the National Vulnerability Database (NVD), the flaw carries a CVSS score of 8.1, which is rated as high severity. The issue arises when Dynamic Method Invocation (DMI) is enabled, allowing remote attackers to execute arbitrary code via the "method:" prefix in chained expressions. CISA has set a federal due date of October 11, 2026, for agencies to implement necessary mitigations.

Context and Background

The addition of CVE-2016-3081 to the KEV catalog highlights the persistent risk associated with legacy software configurations that remain in use. Although the CVE was originally identified in 2016, its inclusion in the KEV catalog indicates that the vulnerability is currently being exploited in the wild or poses an imminent threat to federal infrastructure.

CISA’s directive requires stakeholders to apply mitigations in accordance with vendor instructions. The agency emphasizes compliance with Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on risk. If mitigations are unavailable, agencies are instructed to discontinue use of the product. Stakeholders are also responsible for evaluating each asset's internet exposure to ensure adherence to patching guidelines. The NVD record identifies the underlying weaknesses as CWE-77, indicating improper neutralization of special elements used in an OS command.

Who Is Affected

Organizations using specific versions of Apache Struts with Dynamic Method Invocation enabled are directly affected by this vulnerability. The affected version ranges include 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28. Any system running these versions with DMI turned on is susceptible to remote code execution attacks.

Federal agencies are under strict orders to address this vulnerability by October 11, 2026. However, the KEV catalog entry serves as a critical warning to all organizations. CISA notes that the ransomware use status for this vulnerability is currently unknown, but the potential for arbitrary code execution makes it a significant risk vector for attackers seeking initial access or privilege escalation.

What should you do?

Organizations should immediately inventory their systems to identify any instances of the affected Apache Struts versions. If Dynamic Method Invocation is enabled, teams should prioritize disabling this feature or applying available mitigations. For federal agencies, compliance with BOD 26-04 is mandatory before the October 11 deadline. Non-federal entities should treat this as a high-priority security issue given the KEV catalog listing.