CVE DatabaseCVE-2016-3081

Updated 2026-10-09한국어 권고문 →

CVE-2016-30818.1/HIGHCISA KEVCWE-77CWE-77

Apache Struts 2 Dynamic Method Invocation (DMI) Remote Code Execution (CVE-2016-3081, S2-032)

Affected Vendors

Apache

Affected Components

Struts 2

Published Date

2016-04-26

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Apache Struts versions 2.3.19 through 2.3.28 with Dynamic Method Invocation (DMI) enabled.

Impact

Remote attackers can execute arbitrary code (RCE) with server privileges via specially crafted HTTP requests, leading to full system compromise.

Mitigation

Immediately upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 and set 'struts.enable.DynamicMethodInvocation' to 'false'.

Affected Products & Version Scope

Vulnerable versions include Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28. The risk is critical if 'struts.enable.DynamicMethodInvocation' is set to 'true'.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Upgrade to the latest patched versions:
Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 or higher.

Disable DMI in your struts.xml configuration:

xml

<constant name="struts.enable.DynamicMethodInvocation" value="false" />

Implement WAF rules to detect and block requests containing the method: prefix combined with OGNL syntax (e.g., #, @, Runtime.getRuntime()).

Recommended Security Control & Mitigation Partner

Snyk Open Source & Container Security

Organizations using affected Struts 2 versions should prioritize patching and disable DMI functionality immediately to mitigate the risk of remote exploitation.

Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds

Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.

Free Forever Tier · 1-Click GitHub/GitLab Auto-PR

Scan Your Git Repositories for Free

Master DevSecOps: Automated SAST/SCA in GitHub Actions & Kubernetes

View Course Curriculum

Technical Root Cause & Exploitation Mechanics

The S2-032 vulnerability arises from improper handling of the 'method:' prefix when Dynamic Method Invocation (DMI) is enabled in Apache Struts 2. An attacker can inject malicious OGNL (Object-Graph Navigation Language) expressions through this prefix. Because the framework fails to adequately sanitize these expressions before evaluation, it allows for OGNL expression chaining that can bypass security restrictions and execute arbitrary system commands. This vulnerability is listed in CISA's KEV catalog and has a high EPSS score, indicating active exploitation in the wild.

Official Vendor Advisories & References

NVD Original English Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html

Source: secalert@redhat.com · Exploit, Third Party Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en

Source: secalert@redhat.com · Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com · Patch, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com · Third Party Advisory

http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec

Source: secalert@redhat.com · Third Party Advisory, Broken Link

http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec

Source: secalert@redhat.com · Third Party Advisory

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: