CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks

CISA has added a long-standing Apache Struts flaw, tracked as CVE-2016-3081, to its Known Exploited Vulnerabilities catalog after confirming that attackers are using it in real-world attacks. The issue is a command injection vulnerability in Apache Struts that can allow a remote attacker to run code on a vulnerable server when Dynamic Method Invocation is enabled. CISA added the vulnerability on October 8, 2026, and gave U.S. federal civilian agencies until October 11 to address it under Binding Operational Directive 26-04. The agency also marked the flaw as requiring forensic triage, meaning affected organizations should not treat patching as the only task. Security teams should also check whether attackers may have already...

Read the full article at the source.