PatchTheCVECVE-2016-3081: Apache Struts Command Injection Vulnerability
93
Patch now
HIGH 8.1EXPLOITEDREMOTEWATCHLISTMITIGATEDOWNGRADEDOWNGRADE
CVE-2016-3081 is a high-severity flaw (CVSS 8.1) affecting agile controller-campus firmware, anyoffice, logcenter, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Why this priority
- High severity
- EPSS top 1%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 96.1% (top 1%) |
| CISA exploited list | Yes, fix due 2026-10-11 |
| Weakness | CWE-77 |
| Published | 2016-04-26 |
| Last modified | 2026-10-09 |
Publisher (CNA): Red Hat, Inc. · Vendor: huawei
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Updated Record last modified
- Deadline CISA due date for US federal agencies to patch
huawei agile controller-campus firmware MITIGATE
Affected: v100r002c00
Fixed in: no fixed release known
Safe to downgrade to: a release before v100r002c00
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
huawei anyoffice DOWNGRADE
Affected: v200r005c00 · v200r006c00
Fixed in: no fixed release known
Safe to downgrade to: a release before v200r005c00
1. Check installed version
apt-cache policy anyoffice || rpm -q anyoffice || anyoffice --version
2. No fixed release: DOWNGRADE to a release before v200r005c00 (Debian / Ubuntu)
apt-cache madison anyoffice
sudo apt install anyoffice=<VERSION_BEFORE_v200r005c00>
sudo apt-mark hold anyoffice
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list anyoffice
sudo dnf downgrade anyoffice-<VERSION_BEFORE_v200r005c00>
sudo dnf versionlock add anyoffice
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
huawei logcenter DOWNGRADE
Affected: v100r001c10 · v100r001c20
Fixed in: no fixed release known
Safe to downgrade to: a release before v100r001c10
1. Check installed version
apt-cache policy logcenter || rpm -q logcenter || logcenter --version
2. No fixed release: DOWNGRADE to a release before v100r001c10 (Debian / Ubuntu)
apt-cache madison logcenter
sudo apt install logcenter=<VERSION_BEFORE_v100r001c10>
sudo apt-mark hold logcenter
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list logcenter
sudo dnf downgrade logcenter-<VERSION_BEFORE_v100r001c10>
sudo dnf versionlock add logcenter
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
huawei firehunter6000 firmware MITIGATE
Affected: v100r001c20
Fixed in: no fixed release known
Safe to downgrade to: a release before v100r001c20
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
huawei oceanstor 5300 v3 firmware MITIGATE
Affected: v300r001 · v300r002 · v300r003c00 · v300r003c10
Fixed in: no fixed release known
Safe to downgrade to: a release before v300r001
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
huawei oceanstor 5500 v3 firmware MITIGATE
Affected: v300r001 · v300r002 · v300r003c00 · v300r003c10
Fixed in: no fixed release known
Safe to downgrade to: a release before v300r001
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Maven · org.apache.struts:struts2-core · FIXED · 2.3.20.3 · vulnerable: >= 2.3.19, <= 2.3.20.2 · source
Set org.apache.struts:struts2-core to 2.3.20.3 or later in pom.xml or build.gradle, then rebuild and redeploy.
Fedora 46 · uv · FIXED · 0.13.5-1.fc46 · FEDORA-2026-61ea5a28c6 · source
sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Write-up: www.exploit-db.com/exploits/39756/
- Exploit-DB: Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)
- Metasploit: Apache Struts Dynamic Method Invocation Remote Code Execution
- Nuclei scan template: Apache S2-032 Struts - Remote Code Execution
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.