The US Cybersecurity and Infrastructure Security Agency (CISA) has added a long-standing Apache Struts flaw, tracked as CVE-2016-3081, to its Known Exploited Vulnerabilities (KEV) catalogue after confirming that attackers are using it in real-world attacks. CISA added the vulnerability on 8 October 2026 and gave US federal civilian agencies until 11 October to address it under Binding Operational Directive 26-04. The listing is a warning to every organisation still running vulnerable Struts applications, not just federal agencies.

How the flaw works

The issue is a command injection vulnerability in Apache Struts that can allow a remote attacker to run code on a vulnerable server when Dynamic Method Invocation is enabled. The weakness is classified as CWE-77, covering cases where untrusted input can reach an operating system command interpreter. When Dynamic Method Invocation is switched on, an attacker may abuse the method prefix in a crafted request to trigger arbitrary code execution. That level of access can enable data theft, malware deployment, credential collection, or using the server as a path into other parts of the network.

What defenders must do

CISA also marked the flaw as requiring forensic triage, meaning affected organisations should not treat patching as the only task: security teams should check whether attackers may already have accessed exposed systems. Apache Struts is a widely used Java framework, and older applications built on it can linger unpatched for years, which is exactly why a decade-old flaw can reappear in the exploited list. Administrators should disable Dynamic Method Invocation where it is not needed, apply the vendor's fix, and review logs and systems for signs of compromise. If exploitation is suspected, incident response should begin immediately rather than waiting for the next patch cycle.