# CISA KEV: Apache Struts Dynamic Method Invocation Remote Code Execution (CVE-2016-3081 / S2-032) Exploited in Attacks

> CISA added Apache Struts CVE-2016-3081 (S2-032), a command injection / remote code execution flaw reachable via the method: prefix when Dynamic Method Invocation (DMI) is enabled, to its Known Exploited Vulnerabilities catalog on 2026-10-08, citing active exploitation. The flaw dates to 2016 and is fixed in Struts 2.3.20.3, 2.3.24.3 and 2.3.28.1.

- **Published:** 2026-10-12T07:57:00Z
- **Last reviewed:** 2026-10-12T07:57:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3332
- **ID:** TL-2026-3332
- **Severity:** CRITICAL (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2016-3081

## Description

CVE-2016-3081 (Apache Struts security bulletin S2-032, credited to Nike Zheng) affects Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28 when Dynamic Method Invocation is enabled. A remote, unauthenticated attacker can execute arbitrary code by sending a request containing the method: prefix, which is evaluated as an OGNL expression (NVD: 'related to chained expressions'). The Apache bulletin rates it Important. NVD classifies the weakness as CWE-77 and scores it CVSS v3.1 8.1 HIGH (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v2 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C). It was published 2016-04-26. The platform severity is set to CRITICAL because CISA confirmed active exploitation and a federal remediation deadline; public trackers also report a very high EPSS exploitation probability (about 94%).

A public exploit has existed since 2016: Exploit-DB EDB-39756 is a Metasploit module (contributor Nixawk, released 2016-05-02, rank Excellent, Linux x86 target). It sends an HTTP request carrying a URI-encoded OGNL expression in the method: parameter, manipulates the _memberAccess object to bypass OGNL security restrictions, and either runs commands directly through java.lang.Runtime.exec() or uploads a Base64-encoded executable to /tmp/ (or a custom temp path), marks it executable and runs it with shell commands. The default payload is linux/x86/meterpreter/reverse_tcp_uuid, and the module includes a check function that evaluates an arithmetic OGNL expression to confirm vulnerability. The default target URI in the module is /blank-struts2/login.action.

CISA added the CVE to the KEV catalog on 2026-10-08 with a due date of 2026-10-11 under BOD 26-04; known ransomware campaign use is listed as Unknown. The reporting source states exploitation can lead to data theft, malware deployment, credential collection, or use of the server as a path into other parts of the network, and that affected servers need forensic triage rather than patching alone. The sources reviewed do not identify the exploiting actor, campaign, or any network infrastructure, so no attribution or network IOCs are asserted. NVD also lists Huawei (OceanStor, AnyOffice, LogCenter, AgileController) and Oracle (FlexCube Private Banking, Micros Retail XBRI Loss Prevention, Siebel E-Billing) products as affected because they bundle vulnerable Struts; NVD references Oracle bulletins from July and October 2016 and a Huawei advisory. Note that the Apache bulletin and Exploit-DB text describe the affected range slightly differently (2.3.20 through 2.3.28 excluding the patched builds); this record uses the NVD ranges. Defenders should look for requests carrying method: parameters with OGNL syntax and for unexpected child processes of the Java application server.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1005 Data from Local System
- T1222.002 Linux and Mac Permissions

## Sources

- [CISA Known Exploited Vulnerabilities Catalog - CVE-2016-3081](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081)
- [CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks](https://cybersecuritynews.com/apache-struts-vulnerability-exploited/)
- [NVD - CVE-2016-3081](https://nvd.nist.gov/vuln/detail/CVE-2016-3081)
- [Apache Struts Security Bulletin S2-032](https://cwiki.apache.org/confluence/display/WW/S2-032)
- [Apache Struts S2-032 (docs)](https://struts.apache.org/docs/s2-032.html)
- [Exploit-DB 39756 - Apache Struts Dynamic Method Invocation RCE (Metasploit)](https://www.exploit-db.com/exploits/39756/)
- [SecurityFocus BID 87327](http://www.securityfocus.com/bid/87327)
- [Rapid7 Vulnerability DB - Struts CVE-2016-3081](https://www.rapid7.com/db/vulnerabilities/struts-cve-2016-3081)
- [Oracle Critical Patch Update Advisory - October 2016](https://www.oracle.com/security-alerts/cpuoct2016verbose.html)
- [GCVE / CVE record - CVE-2016-3081](https://db.gcve.eu/vuln/cve-2016-3081)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3332