---
title: "Apache Struts S2-032 (CVE-2016-3081): 2016 RCE Now in KEV"
url: https://erroneo.us/security/briefs/apache-struts-s2-032-cve-2016-3081-dmi-rce/
description: "Struts 2.3.20-2.3.28 RCE via method: prefix, only with Dynamic Method Invocation on. In KEV after a China-linked advisory. 2.3.x is EOL: find it, migrate."
type: security-brief
section: "Security Digest"
date_published: 2016-04-19
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2016-3081"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apache Struts S2-032 (CVE-2016-3081): 2016 RCE Now in KEV

**Verdict: Check exposure.** Only Struts 2.3.20 to 2.3.28 apps with Dynamic Method Invocation turned on are exposed, but any Struts 2.3.x you find is end-of-life, open to worse KEV-listed bugs, and should be fixed or pulled now.

- **Who must act:** Owners of legacy Java web apps or vendor appliances that bundle Struts 2.3.x, most urgently internet-facing ones with struts.enable.DynamicMethodInvocation set to true.
- **Who can relax:** Teams with no Struts in their stack, and apps on supported Struts releases (7.4.0 is the project's current best available), which are not affected by S2-032.
- **Affected:** Apache Struts 2.3.20 through 2.3.28, except 2.3.20.3 and 2.3.24.3 (Apache bulletin); CVE record / GHSA: 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, 2.3.25 to 2.3.28; Only when Dynamic Method Invocation is enabled; Vendor products embedding these versions (NVD lists Huawei and Oracle products)
- **Fixed:** Struts 2.3.20.3; Struts 2.3.24.3; Struts 2.3.28.1; Supported line: Struts 7.4.0 (2.3.x is end-of-life since Sep 2019)
- **CVEs:** CVE-2016-3081
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every struts2-core jar on servers and in WAR/EAR files and note its version.
2. Check struts.xml and struts.properties for struts.enable.DynamicMethodInvocation; if it is true, set it to false and redeploy today.
3. Treat any Struts 2.3.x as end-of-life and plan a migration to a supported release; 2.3.28.1 only fixes S2-032.
4. Ask vendors of appliances or packaged apps that embed Struts 2.3.x for fixed builds, and keep their web interfaces off the internet meanwhile.
5. If an affected app with DMI on was internet-facing, hunt for compromise before you patch over the evidence.

### How to check if you are affected

- Search web and app-server access logs for request parameters starting with method: followed by an OGNL expression, for example grep -E 'method:(%23|#)'.
- Look for shells or other processes spawned by the Java or Tomcat process, and for unexpected outbound connections from the app server.
- Check web roots for unfamiliar JSP files or jars; AA26-281A lists web shells such as error.jsp and yaml-payload.jar with hashes.

## What happened

On April 19, 2016, the Apache Struts project published bulletin [S2-032](https://cwiki.apache.org/confluence/display/WW/S2-032) (CVE-2016-3081) and released Struts 2.3.20.3, 2.3.24.3 and 2.3.28.1 to fix it ([announcement](https://struts.apache.org/announce-2016)). When Dynamic Method Invocation (DMI) is enabled, an attacker can send an OGNL expression in a request parameter that uses the `method:` prefix, and the server runs it. Apache rated the bug "Important" and credited Nike Zheng of DBAPPSecurity. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-3081) scores it CVSS 3.1 8.1, with high attack complexity. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2016-3081) has linked public exploit code since 2016, including an Exploit-DB entry and Metasploit modules.

So why is it in KEV in 2026? On October 8, the FBI, CISA, NSA and agencies from the UK, Australia, Canada, Japan, New Zealand and Spain published [AA26-281A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a). The advisory covers actors enabled by Integrity Technology Group, which CISA describes as a [China-based company with government ties](https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat), and whose tradecraft matches activity known as Flax Typhoon, Ethereal Panda and Red Juliett. According to the advisory, the actors have used "MicroScan", a web app with more than 1,300 scanning scripts, since as early as 2017 against targets including Apache Struts. Its Appendix B lists CVE-2016-3081 among eight "successfully exploited" CVEs recovered from those scripts. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081) the same day, with an October 11 deadline. The advisory gives no date, victim or detail for the Struts exploitation specifically. We found no other public 2026 reporting of S2-032 exploitation.

## Who is affected

Apache's bulletin lists Struts 2.3.20 to 2.3.28, except 2.3.20.3 and 2.3.24.3. The CVE record, AA26-281A and [GHSA-8c6j-ffmf-q6vm](https://github.com/advisories/GHSA-8c6j-ffmf-q6vm) start the range at 2.3.19. The bug matters only when DMI is on. In these releases the framework's [default.properties](https://github.com/apache/struts/blob/STRUTS_2_3_28/core/src/main/resources/org/apache/struts2/default.properties) ships `struts.enable.DynamicMethodInvocation = false`, so an app has to turn DMI on itself. Any app that relies on [DMI-style](https://struts.apache.org/core-developers/action-configuration) `Action!method` URLs or `method:` parameters has it on.

The entire 2.3.x line reached end-of-life on September 12, 2019 ([announcement](https://struts.apache.org/announce-2019)). The project's current "best available" release is 7.4.0 ([releases](https://struts.apache.org/releases.html)). The apps still affected are in-house Java apps from the mid-2010s that nobody upgraded, and commercial products that bundle Struts. NVD's configuration lists Huawei products, including OceanStor storage firmware, AnyOffice, LogCenter and Agile Controller-Campus, and Oracle products, including FLEXCUBE Private Banking, MICROS Retail XBRi Loss Prevention and Siebel e-Billing.

## Do you really need to act?

Most teams can relax about S2-032 itself. It needs a nine-year-old Struts release and a non-default setting. The honest problem is what a hit means. Any app on 2.3.20 through 2.3.28 is also exposed to [S2-045](https://cwiki.apache.org/confluence/display/WW/S2-045) (CVE-2017-5638), which affects 2.3.5 through 2.3.31 through the Jakarta multipart parser, the 2.3.x default, needs no DMI, and has been in KEV since 2021. Upgrading to 2.3.28.1 closes S2-032 and nothing after it. If you find Struts 2.3.x, the fix is migration, or isolation until you can migrate. If the app faces the internet with DMI on, treat it as urgent.

## What to do now

1. Find Struts: `find / -name 'struts2-core-*.jar' 2>/dev/null`, `unzip -l app.war | grep struts2-core`, or `mvn dependency:tree -Dincludes=org.apache.struts:struts2-core`.
2. Check DMI: `grep -rn DynamicMethodInvocation WEB-INF/ src/main/resources/`. If the value is `true`, set `<constant name="struts.enable.DynamicMethodInvocation" value="false"/>` in `struts.xml` and redeploy. This is Apache's documented workaround. Test first for `!method` URLs that depend on DMI.
3. Schedule a migration to a supported Struts release, and use 2.3.28.1 only as a stopgap.
4. For vendor appliances, ask the vendor for fixed builds and keep the web UI on a management network.
5. If an exposed app had DMI on, hunt for compromise before you change anything.

## How to tell if you were hit

Exploit payloads arrive as request parameters, so check access logs. A legitimate DMI parameter names a method. An attack carries an OGNL expression, so search for `grep -E 'method:(%23|#)' access_log*`. Look for shells, `curl` or `wget` spawned by the Java or Tomcat process, and for outbound connections from the app server. AA26-281A lists web shells this actor uses, including `error.jsp` and `yaml-payload.jar`, with hashes, plus STIX indicators. Check web roots for unfamiliar JSP files. If you find signs of compromise, rebuild the host and rotate the database and service credentials the app held.

## Timeline

- Apr 19, 2016 — Apache publishes S2-032 and releases Struts 2.3.20.3, 2.3.24.3 and 2.3.28.1.
- Apr 26, 2016 — CVE-2016-3081 is published.
- Sep 12, 2019 — Struts 2.3.x reaches end-of-life.
- Oct 8, 2026 — AA26-281A lists the CVE as successfully exploited, and CISA adds it to KEV ([coverage](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)).
- Oct 11, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Apache Struts — S2-032 security bulletin](https://cwiki.apache.org/confluence/display/WW/S2-032)
2. [CVE record — CVE-2016-3081](https://www.cve.org/CVERecord?id=CVE-2016-3081)
3. [NVD — CVE-2016-3081](https://nvd.nist.gov/vuln/detail/CVE-2016-3081)
4. [CISA — Known Exploited Vulnerabilities: CVE-2016-3081](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081)
5. [Apache Struts — Announcements 2016 (2.3.28.1, 2.3.20.3 and 2.3.24.3 releases)](https://struts.apache.org/announce-2016)
6. [Apache Struts — Announcements 2019 (Struts 2.3.x reached End-Of-Life)](https://struts.apache.org/announce-2019)
7. [Apache Struts — Releases](https://struts.apache.org/releases.html)
8. [Apache Struts — default.properties at STRUTS_2_3_28](https://github.com/apache/struts/blob/STRUTS_2_3_28/core/src/main/resources/org/apache/struts2/default.properties)
9. [Apache Struts — Action Configuration (Dynamic Method Invocation)](https://struts.apache.org/core-developers/action-configuration)
10. [Apache Struts — S2-045 security bulletin (CVE-2017-5638)](https://cwiki.apache.org/confluence/display/WW/S2-045)
11. [GitHub Advisory Database — GHSA-8c6j-ffmf-q6vm](https://github.com/advisories/GHSA-8c6j-ffmf-q6vm)
12. [CISA, FBI, NSA et al. — AA26-281A: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a)
13. [CISA — CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors](https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat)
14. [The Hacker News — Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)

---
Source page: https://erroneo.us/security/briefs/apache-struts-s2-032-cve-2016-3081-dmi-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt