CVE-2016-3081
high CISA KEVApache Struts Command Injection Vulnerability
Vendor / product: Apache — Struts
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVSS
8.1
8.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2016-04-26 14:59
Modified: 2026-10-09 14:43
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Listed in CISA KEV
Added 2026-10-08 · due 2026-10-11
Known ransomware use: Unknown
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
huawei / agile_controller-campus_firmware v100r002c00
huawei / anyoffice v200r005c00, v200r006c00
huawei / logcenter v100r001c10, v100r001c20
huawei / firehunter6000_firmware v100r001c20
huawei / oceanstor_5300_v3_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_5500_v3_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_5600_v3_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_5800_v3_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_6800_v3_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_18500_v3_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_18500f_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_18800_v3_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_18800f_firmware v300r001, v300r002, v300r003c00, v300r003c10
huawei / oceanstor_9000_firmware v100r001c01, v100r001c30, v300r005c00
huawei / oceanstor_n8500_firmware v200r001c09spc505, v200r001c91spc205, v200r001c91spc900, v200r001c91spc901
huawei / oceanstor_onebox_firmware v100r003c10
apache / struts ≥2.3.20 <2.3.20.3, ≥2.3.21 <2.3.24.3, ≥2.3.25 <2.3.28.1
oracle / flexcube_private_banking 2.0.0.0, 2.0.1, 2.2.0, 12.0.1, 12.0.3, 12.1.0
oracle / micros_retail_xbri_loss_prevention 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1
oracle / siebel_e-billing 7.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://struts.apache.org/docs/s2-032.html
Vendor advisory: https://struts.apache.org/docs/s2-032.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Patch / mitigation: https://struts.apache.org/docs/s2-032.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Patch / mitigation: https://struts.apache.org/docs/s2-032.html
References
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation... secalert@redhat.com
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en secalert@redhat.com
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html secalert@redhat.com
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html secalert@redhat.com
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec secalert@redhat.com
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec secalert@redhat.com
- http://www.securityfocus.com/bid/87327 secalert@redhat.com
- http://www.securityfocus.com/bid/91787 secalert@redhat.com
- http://www.securitytracker.com/id/1035665 secalert@redhat.com
- https://struts.apache.org/docs/s2-032.html secalert@redhat.com
- https://www.exploit-db.com/exploits/39756/ secalert@redhat.com
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation... af854a3a-2127-422b-91ae-364da2661108
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en af854a3a-2127-422b-91ae-364da2661108
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html af854a3a-2127-422b-91ae-364da2661108
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html af854a3a-2127-422b-91ae-364da2661108
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec af854a3a-2127-422b-91ae-364da2661108
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec af854a3a-2127-422b-91ae-364da2661108
- http://www.securityfocus.com/bid/87327 af854a3a-2127-422b-91ae-364da2661108
- http://www.securityfocus.com/bid/91787 af854a3a-2127-422b-91ae-364da2661108
- http://www.securitytracker.com/id/1035665 af854a3a-2127-422b-91ae-364da2661108
- https://struts.apache.org/docs/s2-032.html af854a3a-2127-422b-91ae-364da2661108
- https://www.exploit-db.com/exploits/39756/ af854a3a-2127-422b-91ae-364da2661108
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
CISA KEV — fetched 2026-10-27 06:50 UTC · record ↗
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗