---
title: "Security digest: April 19, 2016"
url: https://erroneo.us/security/2016-04-19/
description: "April 19, 2016 vulnerability digest: 1 brief (S2-032). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2016-04-19
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 19, 2016

1 editorial brief.

## Take stock

- Check exposure: S2-032 . Owners of legacy Java web apps or vendor appliances that bundle Struts 2.3.x, most urgently internet-facing ones with struts.enable.DynamicMethodInvocation set to true.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Apache Struts S2-032 (CVE-2016-3081): 2016 RCE Now in KEV](https://erroneo.us/security/briefs/apache-struts-s2-032-cve-2016-3081-dmi-rce/index.md): Only Struts 2.3.20 to 2.3.28 apps with Dynamic Method Invocation turned on are exposed, but any Struts 2.3.x you find is end-of-life, open to worse KEV-listed bugs, and should be fixed or pulled now.

## Known exploited (CISA KEV)

None.

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2016-04-19/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt