CVE-2016-3081 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2016-04-26

Added to CISA KEV: 2026-10-08 3817 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise — this vulnerability is in CISA KEV indicating active exploitation in the wild. Review web server access logs for requests containing 'method:' prefix patterns, unusual OGNL expressions, or suspicious action URL patterns (e.g., '?method:%23_memberAccess'). Check for unexpected outbound connections, new user accounts, web shells, or modified application files.
IMMEDIATE: Upgrade Apache Struts 2 to version 2.3.28.1 or later (or the latest stable 2.5.x/6.x release). Treat this as an emergency patch given KEV status and public exploit availability.
IMMEDIATE WORKAROUND: If patching cannot be done immediately, disable Dynamic Method Invocation in struts.xml by setting 'struts.enable.DynamicMethodInvocation = false'. This removes the primary exploitation vector without requiring an upgrade.
Deploy WAF rules to detect and block requests containing 'method:' prefixes and OGNL expression patterns in Struts action URLs. ModSecurity and most commercial WAFs have signatures for this vulnerability (S2-032).
Audit all Java applications in your environment to identify Struts 2 dependencies, including applications bundled within Oracle Fusion Middleware, WebLogic, or Huawei products — apply vendor-specific patches from Oracle (July/October 2016 CPU) and Huawei (SA-20160527).
Implement network segmentation to limit outbound connectivity from application servers — even if exploited, restricting egress reduces the attacker's ability to establish reverse shells or exfiltrate data.
Monitor for post-exploitation indicators: web shell files in application directories, new cron jobs or scheduled tasks, unusual process spawning from the JVM process (e.g., 'java' spawning 'bash', 'sh', 'cmd', 'powershell'), and unexpected network connections from the application server.
Patch priority: CRITICAL — exploit publicly available, no authentication required, KEV listed. Treat as P1/emergency remediation within 24–48 hours for internet-facing systems.

🔍 Web Intelligence (Kagi · 2026-10-08)

Summary

CVE-2016-3081 is a remote code execution (RCE) vulnerability affecting the Apache Struts framework when the Dynamic Method Invocation (DMI) feature is enabled. The vulnerability stems from improper input validation within the framework’s REST plugin and DMI mechanism, which allows attackers to send maliciously crafted requests to manipulate object properties or execute arbitrary system commands ^[2]^[3]. This vulnerability is significant because it allows unauthenticated remote attackers to execute code with the privileges of the web application server, potentially leading to a full system compromise ^[2].

Exploitation

Active Exploitation: The vulnerability has been observed in the wild and is recognized as a known exploited vulnerability ^[1].
Threat Actors/Campaigns: While widely used in various automated exploit campaigns, specific attribution to major ransomware groups is often generalized under broad exploitation of vulnerable Struts deployments.
Proof-of-Concept/Exploit Availability: Public exploit code is available, including modules within the Metasploit Framework (e.g., `struts_dmi_exec.rb`) ^[5].
Prerequisites: Exploitation is possible over a network without authentication or user interaction, provided the Dynamic Method Invocation feature is enabled in the affected Apache Struts configuration ^[1]^[2].

Affected Products & Patches

Affected Versions: Apache Struts versions 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 are vulnerable ^[1].
Patch/Hotfix: Users should upgrade to Apache Struts version 2.3.28.1 or later to resolve the issue.
Mitigations: If upgrading is not immediately possible, the primary mitigation is to disable Dynamic Method Invocation (DMI) in the Struts configuration, which neutralizes the primary vector for this vulnerability ^[1].

Impact

Access/Capability: Successful exploitation grants the attacker the ability to execute arbitrary code with the same privileges as the user running the Java Web Container (e.g., Tomcat, JBoss).
Business Risk: For internet-facing deployments, this presents a critical risk, as it allows unauthorized remote attackers to gain full control over the application server, resulting in data breaches, unauthorized access to internal network resources, service disruption, and potential installation of persistent backdoors ^[2]^[4].

Sources

CVE-2016-3081 - Exploits & Severity - Feedly
CVE-2016-3081: Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to... KEVIntel — Known Exploited Vulnerability Intelligence Feed / 46d. Attacker IP IoCs observed in KEVIntel sensors are available to Pro and…
Apache Struts Dynamic Method Invocation Remote Code Execution (CVE-2016 ...
A remote, unauthenticated vulnerability exists in Apache Struts. The vulnerability allows an attacker to execute arbitrary code on the server with the privileges of the user running the Java Web Container process (e.g. JBoss, Tomcat etc). CVE-2016-3081 is assigned to this vulnerability. Apache Strut…
EOL Fix Available | CVE-2016-3081 | Apache Struts
CVE-2016-3081 is a high-severity vulnerability that arises from the improper handling of user inputs in RESTful endpoints. Specifically, attackers can exploit ... ‍ A Remote Code Execution (RCE) vulnerability (CVE-2016-3081) has been identified in the REST plugin of Apache Struts. This vulnerability…
CVE-2016-3081 Oracle MICROS Retail XBRi Loss Prevention...
A vulnerability was found in Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1. This vulnerability is identified as CVE-2016-3081. You should upgrade the affected component.The product constructs all or part of a command using externally-influenced input from an upstream component, but it does…
CVE-2016-3081 | AttackerKB
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control Impact.Apache Struts Dynamic Method Invocation Remote Code Execution (https://github.com/rapid7/metasploit-framework/blob/master/modules/…

🔴 CVE-2016-3081