How do you patch or mitigate CVE-2016-3081 (Apache Struts Command Injection)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Cyber Security

CISA's required action for CVE-2016-3081 is to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What CVE-2016-3081 requires you to do first

The first step is to confirm where Apache Struts is actually deployed, then verify whether any internet-facing or externally reachable application still uses the vulnerable component. For actively exploited issues, treat inventory accuracy as part of the fix, because patching the wrong system while missing a live one leaves exposure in place.

Because this CVE is in the category of exploited web application flaws, the practical priority is to follow the vendor’s remediation path rather than improvising a local workaround. Use the guidance in the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database to anchor your internal triage, then verify which Struts applications need urgent attention.

How to reduce exposure if patching is delayed

If you cannot patch immediately, the goal is to shrink the exploit path, not to assume the risk is merely deferred. Remove public reachability where you can, place the application behind stronger filtering, and disable or isolate the specific functionality that exposes the command injection path until the vendor fix is in place.

Use the vendor’s mitigation instructions as the controlling source of truth, then apply compensating controls that match the asset’s exposure profile. For a vulnerable application that must stay online, the safest interim posture is the narrowest possible access, the most restrictive request handling you can support, and continuous monitoring for abnormal requests or post-exploitation activity.

When a fix is unavailable, the decision should be binary: either the product is taken out of service or the organization accepts the residual risk with a documented exception and a clear expiry. That is especially important for systems reachable from the internet, where command injection can move quickly from vulnerability to full application compromise.

What to check after remediation or suspected compromise

After patching, do not stop at version confirmation. Check for signs that the system was already used before the fix, including unexpected process launches, altered web application files, new users or scheduled jobs, strange outbound connections, and any evidence that the web tier was used as a foothold for broader access.

If the application handled authentication, session state, service credentials, API keys, or other secrets, rotate what it could have exposed. That matters because command injection often turns a web flaw into a broader trust failure, especially when the application can read local files, reach back-end systems, or interact with privileged infrastructure.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE patching and KEV-driven triage are continuous vulnerability management tasks.
Recommendation — Prioritize and verify remediation for the exploited Struts flaw across all exposed assets.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This CVE requires identifying affected assets and tracking remediation status.
	SI-2 — Flaw Remediation	The subject is immediate remediation of a known exploited software flaw.
Recommendation — Scan for affected Struts deployments and track remediation until exposure is removed. Apply the vendor fix or approved mitigation and document the remediation outcome.
OWASP ASVS	V15 — Secure Coding and Architecture	Command injection in a web app maps to secure architecture and injection resistance.
Recommendation — Review the application’s request handling and remove the command-injection path.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	This CVE is a public-facing application exploitation scenario.
Recommendation — Hunt for exploitation attempts against the exposed Struts application and related logs.
OWASP API Security Top 10	API8 — Security Misconfiguration	Mitigation often depends on restricting exposure and hardening the application surface.
Recommendation — Harden the exposed service and remove unnecessary access paths while remediation is in progress.

Practitioner Guidance

What to prioritise: Patch the exposed Struts instance first, then verify whether the application was reachable from outside the trusted network and whether any high-value backend connections increase blast radius.

What to verify: Confirm the vendor mitigation has been applied on every live instance, not just the asset you planned to patch, and retain evidence that the vulnerable endpoint is no longer reachable or callable in the old form.

Decision rule: If mitigation cannot be applied promptly and the application is externally exposed, treat shutdown or service removal as the safer option than leaving a known command-injection path available.

Practitioner takeaway: For exploited web flaws, the real control is not only patch deployment, but proof that the vulnerable attack path is gone and that the system was not already used before you closed it.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org