Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Fix
Public exploits 2
- uday952/CVE-2026-104711 PoC on GitHub
- uday952/CVE-2026-104711-POC-NEW-VARIANT PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
- https://cwiki.apache.org/confluence/display/WW/S2-075 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · apacheNVD modified 2026-10-08 19:05
Affected (CPE criteria) 1
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
References 2
- https://cwiki.apache.org/confluence/display/WW/S2-075 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/05/10 Mailing List, Third Party Advisory