CVE-2016-3081: Apache Struts

Vendor: Apache
Product: Struts
Vulnerability: Apache Struts Command Injection Vulnerability
Date added: Oct 8, 2026
CISA due date (U.S. federal agencies): Oct 11, 2026
Known ransomware campaign use: Unknown
Weakness (CWE): CWE-77

References

NVD — CVE-2016-3081
cwiki.apache.org
www.cisa.gov
www.cisa.gov
nvd.nist.gov

This site summarizes CISA's catalog for information only. It is not security advice — follow your vendor's guidance and official advisories.

Last updated: Oct 9, 2026 11:13 UTC · Catalog version 2026.10.08

About this page

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.