CVE-2016-3081

8.1 high KEV · due 2026-10-11 exploit ×2 SSVC exploitation: active Analyzed

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Fix

Public exploits 2

Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit) (remote · linux) Exploit-DB · verified · 2016-05-02
Apache Struts Dynamic Method Invocation Remote Code Execution (exploit module) Metasploit · verified · 2016-04-27

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

CISA KEV required action · due 2026-10-11

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Added to the catalog 2026-10-08. CISA KEV

Patch, vendor advisory and mitigation references on NVD 4

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
https://struts.apache.org/docs/s2-032.html Patch, Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
https://struts.apache.org/docs/s2-032.html Patch, Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

2026-10-15 00:45First seenCVSS 8.1 · in KEV · huawei, apache, oracleNVD modified 2026-10-09 14:43

Affected (CPE criteria) 64

cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c00:*:*:*:*:*:*:*
cpe:2.3:a:huawei:anyoffice:v200r005c00:*:*:*:*:*:*:*
cpe:2.3:a:huawei:anyoffice:v200r006c00:*:*:*:*:*:*:*
cpe:2.3:a:huawei:logcenter:v100r001c10:*:*:*:*:*:*:*
cpe:2.3:a:huawei:logcenter:v100r001c20:*:*:*:*:*:*:*
cpe:2.3:o:huawei:firehunter6000_firmware:v100r001c20:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r002:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c00:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c10:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r002:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c00:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c10:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r002:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c00:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c10:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r002:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c00:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c10:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r002:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c00:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c10:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r002:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c00:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c10:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r002:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c00:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c10:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r002:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c00:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c10:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r001:*:*:*:*:*:*:*
cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r002:*:*:*:*:*:*:*
and 24 more

References 23

http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit, Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory, Broken Link
http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
http://www.securityfocus.com/bid/87327 Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035665 Third Party Advisory, VDB Entry
https://struts.apache.org/docs/s2-032.html Patch, Vendor Advisory
https://www.exploit-db.com/exploits/39756/ Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit, Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory, Broken Link
http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
http://www.securityfocus.com/bid/87327 Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035665 Third Party Advisory, VDB Entry
https://struts.apache.org/docs/s2-032.html Patch, Vendor Advisory
https://www.exploit-db.com/exploits/39756/ Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 US Government Resource