CVE-2016-3081 is a command injection vulnerability in Apache Struts. CISA added it to the Known Exploited Vulnerabilities catalogue on 8 October 2026, which means attackers have used it in real attacks. Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
How this vulnerability works
CVE-2016-3081 is a command injection flaw in Apache Struts, which matters because attacker-controlled input can be passed into command execution paths rather than staying safely inside application logic. In practical terms, that turns a web request into potential operating system command execution when the unsafe feature is enabled.
The core danger is not just that the application misbehaves, but that remote code execution can follow from a single crafted request when the vulnerable code path is reachable. That makes the issue especially severe in internet-facing Java web applications that expose Struts actions to untrusted users.
Why command injection is dangerous in web frameworks
Command injection is high impact because it can move an attacker from application-layer access to system-level control. Once arbitrary commands run, the attacker may be able to read application data, alter files, create persistence, or use the host as a stepping stone into adjacent systems.
Frameworks amplify the risk when they sit on the boundary between user input and server-side logic. If the framework offers dynamic features that expand or dispatch methods at runtime, a small input-handling mistake can become a direct execution path rather than a simple validation failure.
For a broader view of the attack pattern, see the Web Application Attacks Guide, which covers command injection and related input-driven exploitation patterns.
How organisations assess exposure and remediation priority
Exposure checks should begin with an accurate inventory of applications that use Apache Struts, especially externally reachable services and legacy systems that may still rely on older framework features. Teams should confirm whether the risky dynamic method invocation capability is enabled, because that is the condition that makes this issue exploitable.
Because the vulnerability is in a widely used framework, remediation should be prioritised using the same discipline used for actively exploited software flaws: asset scope, internet exposure, and vendor guidance. The Vulnerability Management Guide is useful for structuring that prioritisation around exposed assets, verification, and remediation tracking.
Authoritative reference points for version and status details are the CVE Program and the NIST National Vulnerability Database. For patch guidance and affected-version specifics, readers should rely on the Apache advisory rather than recreating version lists from memory.
Detection, containment, and post-patch review
Detection should look for command execution indicators around Struts request handling, unusual process spawning by the application server, unexpected outbound connections, and logs that show suspicious method-prefix usage or other signs of crafted input. Web application firewall rules can help reduce exposure, but they should not be treated as a substitute for fixing the vulnerable code path.
If exploitation is suspected, containment should include isolating the host, preserving logs and memory evidence where possible, and reviewing for follow-on actions such as dropped web shells, modified startup scripts, new scheduled tasks, and new local accounts. A successful command injection often creates a broader compromise than the original web request suggests.
After patching, organisations should review the system as though attacker code may already have run. That means checking for persistence, credential theft, tampered configuration, and lateral movement attempts, not just confirming that the vulnerable library was updated.
Risk and Threat Considerations
Because this flaw can permit remote code execution, the main risk is full host compromise rather than a narrow application defect. Internet-exposed Struts applications are especially attractive targets because a single successful exploit can turn a public web entry point into server-side control.
Failure mechanism: The application accepts attacker-controlled input into a Struts code path that reaches command execution, allowing arbitrary operating system commands to run under the application process context.
Impact: Attackers may steal data, deploy malware, create persistence, pivot into internal systems, or use the compromised server as a foothold for broader intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V15 — Secure Coding and Architecture | Command injection is a core insecure design and input-handling failure in web apps. |
| Recommendation — Remove command execution paths from request handling and validate all user-controlled input before it reaches server logic. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | The flaw arises when untrusted input reaches executable server-side command handling. |
| SI-4 — System Monitoring | Exploitation should be detectable through abnormal process and network activity on the host. | |
| Recommendation — Validate and constrain all external input before it can influence executable application behavior. Monitor for suspicious process creation, outbound connections, and web request anomalies tied to the application. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | The subject is an exploitable application-layer vulnerability requiring secure app testing and remediation. |
| Recommendation — Prioritise vulnerable application components for remediation and verify fixes with security testing. | ||
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | The vulnerability enables attacker-driven command execution on the target host. |
| Recommendation — Map observed activity to command execution techniques and investigate the resulting host compromise path. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a priority remediation item anywhere Apache Struts is present, especially on externally reachable applications. The question is not only whether the framework is installed, but whether the vulnerable execution path is reachable in production.
What to watch for: Hunt for signs of server-side command execution after patching, because successful exploitation often leaves behind secondary changes that persist even after the initial flaw is fixed. If compromise indicators exist, rotation of credentials and review of service accounts used by the application may also be necessary.