Apache Struts Remote Code Execution: CISA Mandates Federal Patch by Oct 11
CISA added a high-severity Apache Struts flaw to its catalog, forcing federal agencies to patch or mitigate by October 11 to prevent remote code execution.
Key points
- CVE-2016-3081 allows remote code execution via Dynamic Method Invocation.
- The vulnerability affects Apache Struts versions 2.3.19 through 2.3.28.
- Federal agencies must apply mitigations by October 11, 2026.
The Cybersecurity and Infrastructure Security Agency (CISA) has escalated the urgency around a long-standing Apache Struts vulnerability by adding it to its Known Exploited Vulnerabilities (KEV) catalog. This listing mandates immediate action from federal agencies, setting a strict compliance deadline for mitigation or patching. For managed service providers and enterprise leaders, this move signals that this specific attack vector is now a top-tier priority for risk management and operational security.
How it unfolded
- On October 8, 2026, CISA added CVE-2016-3081 to the KEV catalog.
- The agency set a federal compliance deadline of October 11, 2026, for mitigations.
- The National Vulnerability Database rates the flaw as HIGH severity with a CVSS score of 8.1.
Who is affected
Organizations running Apache Struts versions 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 are at risk. The vulnerability is exploitable only when Dynamic Method Invocation (DMI) is enabled. According to the National Vulnerability Database, attackers can execute arbitrary code remotely by using the `method:` prefix in requests. This allows for chained expression attacks that can compromise the underlying server. CISA notes that while ransomware use is currently unknown, the ability to execute arbitrary code presents a critical operational risk to internet-exposed assets.
The fix
CISA requires stakeholders to apply mitigations in accordance with vendor instructions. Agencies must follow the guidance in BOD 26-04 Prioritizing Security Updates Based on Risk. If mitigations are unavailable for cloud services, the directive suggests discontinuing use of the product. Organizations are responsible for evaluating their asset exposure and ensuring adherence to these patching guidelines. No specific version update is mentioned in the catalog entry, but vendor instructions should be consulted for available patches.
What to do and how to stay safe: Apache Struts
- Audit all web applications to identify Apache Struts versions between 2.3.19 and 2.3.28.
- Verify if Dynamic Method Invocation is enabled in your Struts configuration files.
- Disable DMI if it is not required for your application's functionality to reduce the attack surface.
- Monitor CISA guidance and vendor releases for specific patch instructions once provided.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2016-3081?
The National Vulnerability Database rates CVE-2016-3081 as HIGH severity with a CVSS score of 8.1.
Which Apache Struts versions are vulnerable?
Versions 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28 are affected when Dynamic Method Invocation is enabled.
What is the deadline for federal agencies?
Federal agencies must mitigate this vulnerability by October 11, 2026, according to CISA.
