NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Apache Struts 2 remote code execution flaw CVE-2016-3081 added to CISA's exploited list

CISA says attackers are using CVE-2016-3081, an old Apache Struts 2 flaw that lets them run code on a server. Fixes have existed for years. Businesses running Struts 2.3.20 to 2.3.28 should update to 2.3.20.3, 2.3.24.3 or 2.3.28.1, or switch off Dynamic Method Invocation.

What to do

If your business or a supplier runs Apache Struts 2, check the version. Update to 2.3.20.3, 2.3.24.3 or 2.3.28.1 (or a newer Struts release), or turn off Dynamic Method Invocation. Ask your IT provider if you're unsure.

What’s happening

CISA added CVE-2016-3081, a command injection flaw in Apache Struts 2, to its list of vulnerabilities being used in attacks on 8 October 2026. Struts is a framework used to build Java web applications, so the risk falls on organisations running such servers, not on home devices. Apache's S2-032 bulletin says that when a feature called Dynamic Method Invocation is on, an attacker can send a crafted request using the method: prefix and run their own code on the server. Apache lists Struts 2.3.20 to 2.3.28 as affected, excluding 2.3.20.3 and 2.3.24.3, and rates it Important. The fixed releases are 2.3.20.3, 2.3.24.3 and 2.3.28.1. As a workaround, Apache says to disable Dynamic Method Invocation. NVD scores the flaw 8.1. The flaw is not new: the bulletin was last updated in 2021, so the October listing signals continued attack use against unpatched or forgotten systems. Details of who is attacking and what they are doing with it were not in the pages read.

What
Flaw
Affects
Apache Struts 2 (Java web application framework)
Affected
Apache Struts 2.3.20 through 2.3.28, excluding 2.3.20.3 and 2.3.24.3 (with Dynamic Method Invocation enabled)
Fixed in
2.3.20.3
2.3.24.3
2.3.28.1
CVE
CVE-2016-3081
Since
8 Oct 2026
Closed
8 Oct 2026

Timeline

  1. CISA added

    CISA added CVE-2016-3081 to its list of flaws being used in attacks, according to the CISA details supplied for this record and aggregator pages that mirror the catalogue. Aggregators give a federal remediation deadline of 2026-10-11. I did not read CISA's own page.

  2. UpdateFixed

    Apache's S2-032 bulletin, last updated on this date, lists Struts 2.3.20 to 2.3.28 as affected and gives fixed releases 2.3.20.3, 2.3.24.3 and 2.3.28.1. The page doesn't state the original disclosure date.

Sources

  1. S2-032 (Apache Struts security bulletin)Apache Struts · 13 Feb 2021
  2. CVE-2016-3081 details and CISA KEV listingcipherssecurity.com · 8 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS