CVE-2016-3081 · Critical · CISA KEV

Apache Struts Command Injection: Critical Threat with Active Exploitation

Threat Engine Auto-Feed · data current as of 2026-10-08

CVE-2016-3081 is a command injection vulnerability in Apache Struts, allowing remote code execution when Dynamic Method Invocation is enabled. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog, and has a very high EPSS score, indicating significant exploitation pressure.

  • CVSS:
  • EPSS percentile: 0.99838
  • Exploitation pressure: 85/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 100th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is a command injection, which means an attacker can embed malicious commands within data input that an application then processes. If the application executes these commands without proper validation, the attacker can run arbitrary code on the system, potentially taking full control.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Apache Struts in their web applications, particularly those with Dynamic Method Invocation enabled.
  • Financial services organizations, due to documented targeting by financially motivated actors like FIN7, LockBit affiliates, and APT38.
  • Technology companies, due to documented targeting by state-sponsored and sophisticated threat actors such as APT29 and Scattered Spider.

Misconfigurations that escalate it

  • Enabling Dynamic Method Invocation (DMI) in Apache Struts, which is a precondition for this vulnerability.
  • Lack of robust input validation and sanitization for user-supplied data in web applications.

High-impact scenarios

  • Remote code execution on the server hosting the Apache Struts application, leading to full system compromise.
  • Data theft, system disruption, or deployment of further malware (e.g., ransomware) by attackers.
  • Initial access for sophisticated threat actors to pivot into internal networks and compromise other systems.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Apache Struts application logs for unusual command execution attempts or error messages related to Dynamic Method Invocation.
  • Scan web application environments for Apache Struts versions known to be vulnerable to CVE-2016-3081.
  • Implement Web Application Firewalls (WAFs) with rules designed to detect and block command injection attempts.

Contain

  • Isolate affected Apache Struts instances from the network to prevent further compromise.
  • Disable Dynamic Method Invocation (DMI) if it is not strictly necessary for application functionality.

Patch

  • Upgrade Apache Struts to a version that addresses CVE-2016-3081.

Frontier verdict — Critical

This is a critical vulnerability due to confirmed in-the-wild exploitation (CISA KEV) and extremely high EPSS, demanding immediate attention for Apache Struts users.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.