Threat reportVulnerabilityTL-2026-3332
CISA KEV: Apache Struts Dynamic Method Invocation Remote Code Execution (CVE-2016-3081 / S2-032) Exploited in Attacks
CISA KEV: Apache Struts Dynamic Method Invocation Remote (TL-2026-3332), also tracked as S2-032, is a critical-severity software vulnerability scored CVSS 8.1, first published 2026-10-12. It has no confirmed attribution, affects Apache Struts, references 1 CVE (CVE-2016-3081), maps to 5 MITRE ATT&CK techniques (T1005, T1059, T1059.004), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.1/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3332
- Threat ID
- TL-2026-3332
- Also known as
- S2-032, Apache Struts S2-032
- Severity
- CRITICAL
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, telecoms, retail, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in CISA KEV: Apache Struts Dynamic Method Invocation Remote
Malware and tooling: Meterpreter (Android), linux/x86/meterpreter/reverse_tcp_uuid, Metasploit Framework, metasploit
How CISA KEV: Apache Struts Dynamic Method Invocation Remote works
CISA added Apache Struts CVE-2016-3081 (S2-032), a command injection / remote code execution flaw reachable via the method: prefix when Dynamic Method Invocation (DMI) is enabled, to its Known Exploited Vulnerabilities catalog on 2026-10-08, citing active exploitation. The flaw dates to 2016 and is fixed in Struts 2.3.20.3, 2.3.24.3 and 2.3.28.1.
CVE-2016-3081 (Apache Struts security bulletin S2-032, credited to Nike Zheng) affects Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28 when Dynamic Method Invocation is enabled. A remote, unauthenticated attacker can execute arbitrary code by sending a request containing the method: prefix, which is evaluated as an OGNL expression (NVD: 'related to chained expressions'). The Apache bulletin rates it Important. NVD classifies the weakness as CWE-77 and scores it CVSS v3.1 8.1 HIGH (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v2 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C). It was published 2016-04-26. The platform severity is set to CRITICAL because CISA confirmed active exploitation and a federal remediation deadline; public trackers also report a very high EPSS exploitation probability (about 94%).
A public exploit has existed since 2016: Exploit-DB EDB-39756 is a Metasploit module (contributor Nixawk, released 2016-05-02, rank Excellent, Linux x86 target). It sends an HTTP request carrying a URI-encoded OGNL expression in the method: parameter, manipulates the _memberAccess object to bypass OGNL security restrictions, and either runs commands directly through java.lang.Runtime.exec() or uploads a Base64-encoded executable to /tmp/ (or a custom temp path), marks it executable and runs it with shell commands. The default payload is linux/x86/meterpreter/reverse_tcp_uuid, and the module includes a check function that evaluates an arithmetic OGNL expression to confirm vulnerability. The default target URI in the module is /blank-struts2/login.action.
CISA added the CVE to the KEV catalog on 2026-10-08 with a due date of 2026-10-11 under BOD 26-04; known ransomware campaign use is listed as Unknown. The reporting source states exploitation can lead to data theft, malware deployment, credential collection, or use of the server as a path into other parts of the network, and that affected servers need forensic triage rather than patching alone. The sources reviewed do not identify the exploiting actor, campaign, or any network infrastructure, so no attribution or network IOCs are asserted. NVD also lists Huawei (OceanStor, AnyOffice, LogCenter, AgileController) and Oracle (FlexCube Private Banking, Micros Retail XBRI Loss Prevention, Siebel E-Billing) products as affected because they bundle vulnerable Struts; NVD references Oracle bulletins from July and October 2016 and a Huawei advisory. Note that the Apache bulletin and Exploit-DB text describe the affected range slightly differently (2.3.20 through 2.3.28 excluding the patched builds); this record uses the NVD ranges. Defenders should look for requests carrying method: parameters with OGNL syntax and for unexpected child processes of the Java application server.
MITRE ATT&CK techniques used in TL-2026-3332
Collection
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Initial Access
T1190 Exploit Public-Facing Application
defense-impairment
Affected products and versions in CISA KEV: Apache Struts Dynamic Method Invocation Remote
- Apache — Struts
Vulnerable versions: 2.3.19 to 2.3.20.2; 2.3.21 to 2.3.24.1; 2.3.25 to 2.3.28
Fixed in: 2.3.20.3; 2.3.24.3; 2.3.28.1 - Huawei — OceanStor, AnyOffice, LogCenter, AgileController (bundled Struts, per NVD)
Vulnerable versions: see NVD CPE list - Oracle — FlexCube Private Banking, Micros Retail XBRI Loss Prevention, Siebel E-Billing (bundled Struts, per NVD)
Vulnerable versions: see NVD CPE list
Remediation for CISA KEV: Apache Struts Dynamic Method Invocation Remote
Patches
- Upgrade to Apache Struts 2.3.20.3, 2.3.24.3 or 2.3.28.1 (or later)
- Apply Oracle and Huawei vendor updates for products bundling Struts
Immediate actions
- Disable Dynamic Method Invocation (struts.enable.DynamicMethodInvocation=false) on all Struts 2 applications
- Restrict public access to affected Struts applications and apply network controls
- Review web and application logs for requests containing method: parameters with OGNL syntax
- Hunt for unexpected child processes spawned by the Java application server and for new executables in /tmp
- Perform forensic triage on exposed hosts rather than relying on patching alone
Workarounds
- Disable Dynamic Method Invocation or implement a custom ActionMapper based on the source of the fixed Struts releases
Longer-term hardening
- Inventory applications and bundled products that embed Apache Struts 2
- Follow CISA BOD 26-04 guidance and evaluate internet exposure of Struts-based services
CVEs associated with CISA KEV: Apache Struts Dynamic Method Invocation Remote
Weaknesses (CWE) in CISA KEV: Apache Struts Dynamic Method Invocation Remote
Timeline of CISA KEV: Apache Struts Dynamic Method Invocation Remote
- CVE-2016-3081 (Struts S2-032, reported by Nike Zheng) published in NVD; fixes released in Struts 2.3.20.3, 2.3.24.3 and 2.3.28.1.
- Metasploit module for Struts DMI RCE (Exploit-DB EDB-39756, contributor Nixawk) released publicly, rank Excellent.
- Apache S2-032 bulletin last updated, confirming impact via method: prefix with DMI enabled and recommending disabling DMI or upgrading.
- CISA adds CVE-2016-3081 to the Known Exploited Vulnerabilities catalog citing active exploitation.
- CISA KEV remediation due date for federal civilian agencies under BOD 26-04.
- Cyber Security News reports on the KEV addition and recommends forensic triage, disabling DMI and log review for suspicious method: values.
Sources cited for CISA KEV: Apache Struts Dynamic Method Invocation Remote
- CISA Known Exploited Vulnerabilities Catalog - CVE-2016-3081
- CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
- NVD - CVE-2016-3081
- Apache Struts Security Bulletin S2-032
- Apache Struts S2-032 (docs)
- Exploit-DB 39756 - Apache Struts Dynamic Method Invocation RCE (Metasploit)
- SecurityFocus BID 87327
- Rapid7 Vulnerability DB - Struts CVE-2016-3081
- Oracle Critical Patch Update Advisory - October 2016
- GCVE / CVE record - CVE-2016-3081
Detection coverage for TL-2026-3332
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3332 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.