CVE-2016-3081: Apache Struts Dynamic Method Invocation RCE (KEV)

CVE-2016-3081 is a remote code execution vulnerability in Apache Struts 2.3.20 through 2.3.28 (excluding the 2.3.20.3/2.3.24.3/2.3.28.1 fix releases): when Dynamic Method Invocation is enabled, an unauthenticated attacker can send a crafted OGNL expression through the `method:` prefix and run arbitrary code on the server, and CISA added this decade-old flaw to the Known Exploited Vulnerabilities catalog on 2026-10-08 after observing renewed in-the-wild exploitation of unpatched installs.

CVE-2016-3081 is a command injection vulnerability (CWE-77) in Apache Struts. NVD's configuration data shows it affects Struts 2.3.20 through 2.3.20.2, 2.3.21 through 2.3.24.2, and 2.3.25 through 2.3.28 — fixed in 2.3.20.3, 2.3.24.3 and 2.3.28.1 respectively (NVD).

NVD records a CVSS v3.1 score of 8.1 (high, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), agreed by both the NVD primary scoring and a secondary CNA submission, plus an older CVSS v2.0 primary score of 9.3 (NVD).

Apache's own security bulletin S2-032 states that when Dynamic Method Invocation is enabled, an attacker can "pass a malicious expression which can be used to execute arbitrary code on server side," confirms the same affected range, and recommends upgrading to 2.3.20.3, 2.3.24.3 or 2.3.28.1; where upgrading isn't immediately possible, the listed workaround is to disable Dynamic Method Invocation, or deploy a custom ActionMapper based on the patched source (Apache Struts Security Bulletin S2-032).

Although disclosed in 2016, CISA added CVE-2016-3081 to the KEV catalog on 2026-10-08, with a required-action due date of 2026-10-11 under Binding Operational Directive 26-04, and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.9653 (99.881th percentile) — among the highest EPSS scores on record, consistent with mass scanning of unpatched decade-old Struts installs now that the flaw is actively re-exploited (FIRST EPSS).

Any Struts deployment still on an affected 2.3.x build with Dynamic Method Invocation enabled should be upgraded immediately, or have DMI disabled as an interim measure, and checked for signs of prior compromise given the near-maximal EPSS score and active KEV listing.

• Remote code execution via a crafted OGNL expression through the method: prefix when Dynamic Method Invocation is enabled; NVD configuration data lists the affected ranges as 2.3.20-2.3.20.2, 2.3.21-2.3.24.2, and 2.3.25-2.3.28. — NVD
• CVSS v3.1 base score is 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, agreed by both NVD primary and a secondary CNA submission; an older CVSS v2.0 primary score of 9.3 is also on record. — NVD
• Affected Struts 2.3.20-2.3.28 excluding the 2.3.20.3/2.3.24.3/2.3.28.1 fix releases; workaround is disabling Dynamic Method Invocation or deploying a patched custom ActionMapper. — Apache Struts Security Bulletin S2-032
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-08, due date 2026-10-11, known ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.9653 (99.881th percentile) as of 2026-10-26. — FIRST EPSS