CISA Adds Old Apache Struts Vulnerability to Exploited Vulnerabilities Catalog
CISA added CVE-2016-3081 in Apache Struts to the KEV catalog. The flaw enables remote code execution when Dynamic Method Invocation is enabled.
On October 8, 2026, the U.S. agency CISA added CVE-2016-3081 in Struts to the Known Exploited Vulnerabilities (KEV) catalog. The addition means CISA has recorded exploitation of this old Apache Struts vulnerability in real-world attacks, not just its theoretical existence.
The flaw affects older branches of the Apache Struts framework used in Java applications. Under certain conditions, an attacker can remotely execute arbitrary code on an affected system. A key condition is that the Dynamic Method Invocation (DMI) feature is enabled.
CVE-2016-3081 in Struts Requires DMI to Be Enabled
According to the Apache advisory, the issue is related to processing the method: prefix. If an application uses a vulnerable configuration and has Dynamic Method Invocation enabled, an attacker may abuse this feature for remote code execution.
Apache lists Struts branches 2.3.20 through 2.3.28 as affected, except for releases that already include the fix. The vendor recommends one of two options:
- disable Dynamic Method Invocation,
- upgrade to version 2.3.20.3, 2.3.24.3, or 2.3.28.1.
An exploit module for the vulnerability has also been publicly available in the Metasploit tool for a long time. The availability of a ready-made exploit lowers the technical barrier to exploitation attempts, especially against internet-facing and unmaintained applications.
Checking Older Apache Struts Applications
Operators of legacy deployments should promptly verify the specific Struts version and DMI configuration. The mere presence of an older branch does not, according to available information, automatically mean it is exploitable: it is also decisive whether Dynamic Method Invocation is enabled in the application.
However, adding CVE-2016-3081 in Struts to KEV changes the remediation priority for environments using this combination. For catalog entries, CISA requires following the vendor’s mitigations; in this case, both fixed releases and a configuration-based mitigation are known.
CISA’s public record does not state who is exploiting the flaw, which organizations the attacks targeted, or their scope. It is therefore not confirmed whether this is a new attack wave or a historically exploited vulnerability documented late.
Further information may come from potential technical details provided by CISA or security companies, such as indicators of compromise, campaign data, or clarification of affected deployments.
Sources
- CISA Known Exploited Vulnerabilities Catalog – CISA added CVE-2016-3081 to KEV and states the requirement to follow the vendor’s mitigations.
- Apache Struts S2-032 – Confirms the Dynamic Method Invocation condition, the possibility of remote code execution, affected versions, and recommended fixes or disabling the feature.
- NIST National Vulnerability Database – Corroborates the CVE identifier and technical description of the vulnerability in older Apache Struts branches.
- Exploit Database – Documents a publicly available remote exploit module for CVE-2016-3081.
Verified and updated: 10/09/2026 06:23
