Apache Struts S2-032 (CVE-2016-3081): 2016 RCE Now in KEV

What to do

1. Find every struts2-core jar on servers and in WAR/EAR files and note its version.
2. Check struts.xml and struts.properties for struts.enable.DynamicMethodInvocation; if it is true, set it to false and redeploy today.
3. Treat any Struts 2.3.x as end-of-life and plan a migration to a supported release; 2.3.28.1 only fixes S2-032.
4. Ask vendors of appliances or packaged apps that embed Struts 2.3.x for fixed builds, and keep their web interfaces off the internet meanwhile.
5. If an affected app with DMI on was internet-facing, hunt for compromise before you patch over the evidence.

How to check if you are affected or compromised

• Search web and app-server access logs for request parameters starting with method: followed by an OGNL expression, for example grep -E 'method:(%23|#)'.
• Look for shells or other processes spawned by the Java or Tomcat process, and for unexpected outbound connections from the app server.
• Check web roots for unfamiliar JSP files or jars; AA26-281A lists web shells such as error.jsp and yaml-payload.jar with hashes.

What happened#

On April 19, 2016, the Apache Struts project published bulletin S2-032 (CVE-2016-3081) and released Struts 2.3.20.3, 2.3.24.3 and 2.3.28.1 to fix it (announcement). When Dynamic Method Invocation (DMI) is enabled, an attacker can send an OGNL expression in a request parameter that uses the method: prefix, and the server runs it. Apache rated the bug "Important" and credited Nike Zheng of DBAPPSecurity. NVD scores it CVSS 3.1 8.1, with high attack complexity. The CVE record has linked public exploit code since 2016, including an Exploit-DB entry and Metasploit modules.

So why is it in KEV in 2026? On October 8, the FBI, CISA, NSA and agencies from the UK, Australia, Canada, Japan, New Zealand and Spain published AA26-281A. The advisory covers actors enabled by Integrity Technology Group, which CISA describes as a China-based company with government ties, and whose tradecraft matches activity known as Flax Typhoon, Ethereal Panda and Red Juliett. According to the advisory, the actors have used "MicroScan", a web app with more than 1,300 scanning scripts, since as early as 2017 against targets including Apache Struts. Its Appendix B lists CVE-2016-3081 among eight "successfully exploited" CVEs recovered from those scripts. CISA added the CVE to the KEV catalog the same day, with an October 11 deadline. The advisory gives no date, victim or detail for the Struts exploitation specifically. We found no other public 2026 reporting of S2-032 exploitation.

Who is affected#

Apache's bulletin lists Struts 2.3.20 to 2.3.28, except 2.3.20.3 and 2.3.24.3. The CVE record, AA26-281A and GHSA-8c6j-ffmf-q6vm start the range at 2.3.19. The bug matters only when DMI is on. In these releases the framework's default.properties ships struts.enable.DynamicMethodInvocation = false, so an app has to turn DMI on itself. Any app that relies on DMI-style Action!method URLs or method: parameters has it on.

The entire 2.3.x line reached end-of-life on September 12, 2019 (announcement). The project's current "best available" release is 7.4.0 (releases). The apps still affected are in-house Java apps from the mid-2010s that nobody upgraded, and commercial products that bundle Struts. NVD's configuration lists Huawei products, including OceanStor storage firmware, AnyOffice, LogCenter and Agile Controller-Campus, and Oracle products, including FLEXCUBE Private Banking, MICROS Retail XBRi Loss Prevention and Siebel e-Billing.

Do you really need to act?#

Most teams can relax about S2-032 itself. It needs a nine-year-old Struts release and a non-default setting. The honest problem is what a hit means. Any app on 2.3.20 through 2.3.28 is also exposed to S2-045 (CVE-2017-5638), which affects 2.3.5 through 2.3.31 through the Jakarta multipart parser, the 2.3.x default, needs no DMI, and has been in KEV since 2021. Upgrading to 2.3.28.1 closes S2-032 and nothing after it. If you find Struts 2.3.x, the fix is migration, or isolation until you can migrate. If the app faces the internet with DMI on, treat it as urgent.

What to do now#

1. Find Struts: find / -name 'struts2-core-*.jar' 2>/dev/null, unzip -l app.war | grep struts2-core, or mvn dependency:tree -Dincludes=org.apache.struts:struts2-core.
2. Check DMI: grep -rn DynamicMethodInvocation WEB-INF/ src/main/resources/. If the value is true, set <constant name="struts.enable.DynamicMethodInvocation" value="false"/> in struts.xml and redeploy. This is Apache's documented workaround. Test first for !method URLs that depend on DMI.
3. Schedule a migration to a supported Struts release, and use 2.3.28.1 only as a stopgap.
4. For vendor appliances, ask the vendor for fixed builds and keep the web UI on a management network.
5. If an exposed app had DMI on, hunt for compromise before you change anything.

How to tell if you were hit#

Exploit payloads arrive as request parameters, so check access logs. A legitimate DMI parameter names a method. An attack carries an OGNL expression, so search for grep -E 'method:(%23|#)' access_log*. Look for shells, curl or wget spawned by the Java or Tomcat process, and for outbound connections from the app server. AA26-281A lists web shells this actor uses, including error.jsp and yaml-payload.jar, with hashes, plus STIX indicators. Check web roots for unfamiliar JSP files. If you find signs of compromise, rebuild the host and rotate the database and service credentials the app held.

Timeline#

• Apr 19, 2016 — Apache publishes S2-032 and releases Struts 2.3.20.3, 2.3.24.3 and 2.3.28.1.
• Apr 26, 2016 — CVE-2016-3081 is published.
• Sep 12, 2019 — Struts 2.3.x reaches end-of-life.
• Oct 8, 2026 — AA26-281A lists the CVE as successfully exploited, and CISA adds it to KEV (coverage).
• Oct 11, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2016-3081 · KEV 2026-10-08 · Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apache Struts — S2-032 security bulletin cwiki.apache.org
2. CVE record — CVE-2016-3081 cve.org
3. NVD — CVE-2016-3081 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2016-3081 cisa.gov
5. Apache Struts — Announcements 2016 (2.3.28.1, 2.3.20.3 and 2.3.24.3 releases) struts.apache.org
6. Apache Struts — Announcements 2019 (Struts 2.3.x reached End-Of-Life) struts.apache.org
7. Apache Struts — Releases struts.apache.org
8. Apache Struts — default.properties at STRUTS_2_3_28 github.com
9. Apache Struts — Action Configuration (Dynamic Method Invocation) struts.apache.org
10. Apache Struts — S2-045 security bulletin (CVE-2017-5638) cwiki.apache.org
11. GitHub Advisory Database — GHSA-8c6j-ffmf-q6vm github.com
12. CISA, FBI, NSA et al. — AA26-281A: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data cisa.gov
13. CISA — CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors cisa.gov

Coverage and analysis

1. The Hacker News — Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies thehackernews.com