Is CVE-2016-3081 (Apache Struts Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2016-3081 to its Known Exploited Vulnerabilities catalogue on 8 October 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

What “exploited in the wild” means for this CVE

For a question like this, the key distinction is between a published vulnerability and one that is already being used by attackers. CISA’s KEV catalogue is the practical signal that the issue has crossed from theoretical exposure into confirmed active exploitation. That changes triage from “plan to patch” to “treat as an incident-priority exposure.”

Because this is a command injection flaw in Apache Struts, the operational question is not just whether the product is present, but whether the vulnerable execution path is reachable in your deployment. Confirm where Struts is used, whether the affected request handling path is exposed, and whether any internet-facing or partner-facing systems still rely on it.

How to confirm exposure and scope the response

Start by locating every application and service that embeds Apache Struts, including older web tiers, forgotten test systems, and externally exposed portals. Then determine whether the specific code path tied to method:prefix and Dynamic Method Invocation is enabled in the deployed configuration. If the vulnerable path is not reachable, your risk is lower, but inventory still matters because inherited components are often missed.

Use the vendor advisory and the CISA KEV catalogue for the authoritative version and remediation details rather than reconstructing them from secondary reports. The practical goal is to pair asset discovery with a yes-or-no answer on exposure, then decide whether immediate patching, isolation, or compensating controls are needed.

CISA Known Exploited Vulnerabilities Catalog should be part of that verification step, because KEV status is the strongest public indicator that exploitation is already happening.

What to do when patching cannot happen immediately

If you cannot remediate at once, reduce reachability first. Disable the vulnerable feature path if the application can function without it, restrict exposure at the network and application layers, and place the application under tighter monitoring for suspicious requests or error patterns. For web application injection issues, reducing the attack surface is often the fastest way to cut exposure while change control catches up.

After containment, look backward as well as forward. Review logs for unusual parameter values, unexpected command execution symptoms, web shell indicators, account anomalies, and outbound connections from the affected host. If the application had internet exposure and the vulnerable path was enabled, assume compromise assessment is warranted even if you have not yet seen a successful exploit.

NIST National Vulnerability Database is useful here for tying the CVE record to your internal vulnerability inventory, while CVE Program helps ensure you are tracking the exact identifier consistently across scanners, tickets, and exception workflows.

Why Struts command injection deserves more than routine patching

Command injection is high impact because it can convert a web request into arbitrary code execution on the application host. That means a single reachable flaw can expose application data, credentials in memory or on disk, and sometimes adjacent systems if the server has broad trust or reused secrets. Once attackers get code execution, they often move quickly from exploitation to persistence and follow-on access.

For that reason, actively exploited web application flaws should trigger a broader review than “apply the patch and close the ticket.” The response should include reachability, compromise hunting, and any credential or session material that may have been exposed on the server. In environments where the app server holds deployment secrets, database credentials, or service tokens, rotate what the compromised host could access.

Web Application Attacks Guide is a natural companion for understanding the command injection pattern itself, and Vulnerability Management Guide maps the response to triage, exception handling, and verification.

Risk and Threat Considerations

Once a flaw is in KEV, the risk is no longer hypothetical. Attackers tend to prioritise these issues because the public disclosure, exploitability, and broad software footprint increase the odds of finding exposed targets quickly.

Failure mechanism: A reachable Struts request path can accept attacker-controlled input that is interpreted as a command, allowing remote code execution before normal authentication or application logic can stop it.

Impact: Successful exploitation can lead to full application compromise, data theft, follow-on lateral movement, and, in some environments, the exposure of credentials or sessions that were accessible from the compromised host.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The CVE concerns exploitation of an exposed web application path.
Recommendation — Hunt for public-facing exploitation and validate exposed application paths.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation requires prioritised scanning, triage, and remediation.
Recommendation — Prioritise and remediate exploited vulnerabilities using risk-based workflows.
OWASP ASVS	V5 — File Handling	The issue is a web application injection path that can lead to code execution.
	V15 — Secure Coding and Architecture	Command injection points to insecure request handling and execution boundaries.
Recommendation — Review application validation and server-side handling around executable input paths. Remove dangerous execution paths and enforce safer server-side design.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A KEV-listed CVE needs prompt identification, remediation, and verification.
Recommendation — Remediate the flaw quickly and verify the fix across affected systems.

Practitioner Guidance

What to prioritise: Treat confirmed exposure on internet-facing or externally reachable systems as the top priority. If patching is delayed, the immediate decision is whether the vulnerable path can be disabled or isolated without breaking business-critical service.

What to verify: Confirm both product presence and execution-path reachability. A Struts deployment that exists somewhere in the estate is not enough to justify emergency action unless the vulnerable configuration is actually in use, but once it is reachable you should assume exploitation pressure is real.

Decision rule: If the application server handled sensitive requests, stored secrets, or authenticated users, pair remediation with log review and compromise assessment. If the host had no sensitive trust relationships, the containment focus is narrower, but patching urgency remains high because KEV status indicates active abuse.

Practitioner takeaway: For a KEV-listed web injection flaw, the right question is not only “is it patched,” but “was it reachable, and what else could that server have exposed if an attacker got code execution?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org