CVE-2017-9805 is a deserialization of untrusted data vulnerability in Apache Struts. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What Apache Struts deserialization flaws mean
Deserialization vulnerabilities are dangerous because they let an application turn attacker-controlled data into executable object state. In a framework such as Apache Struts, that can move a flaw from a simple input-handling bug into a pathway for remote code execution, privilege abuse, or full application compromise.
The key security issue is not the technical format of the data alone, but the trust decision around it. If untrusted input reaches a deserialization routine, the application may instantiate unexpected classes, invoke dangerous methods, or trigger follow-on behaviour the developer never intended.
Why this vulnerability class is dangerous in web applications
Web applications often receive serialized content through parameters, headers, files, or integration endpoints. When that content is parsed without strong validation, the attacker can shape the object graph or control the application flow before any normal business logic has a chance to intervene.
That makes deserialization flaws especially high impact in frameworks that are widely deployed and deeply integrated. Once exploitation succeeds, the attacker may not need a second foothold, because the vulnerable application itself becomes the execution point. The public record for the broader class is tracked through the CVE Program and the NIST National Vulnerability Database, which help teams connect an identifier to product exposure and remediation guidance.
For organisations, the practical danger is that exploitation can occur before the issue is visible in logs or before defenders realise the application is processing attacker-supplied serialized content. That is why known exploited vulnerabilities deserve rapid attention, especially when the affected component sits on an internet-facing path.
How organisations assess exposure and reduce blast radius
Exposure checks start with asset inventory, version identification, and dependency tracing. Teams need to know where Apache Struts is deployed, which applications use it directly or indirectly, and whether the vulnerable path is reachable from untrusted networks or exposed service interfaces.
Vendor advisories and the NVD entry should be used to confirm affected scope and the recommended fix path, rather than relying on package names alone. The same issue can appear in a monolith, a legacy web front end, or a bundled application where the framework is hidden several layers down.
Where immediate patching is not possible, compensating controls should reduce attack surface and make exploitation harder. That includes restricting internet exposure, tightening request filtering, segmenting the application, and increasing monitoring around unusual server-side behaviour. A broader Vulnerability Management Guide is useful here because prioritisation should be driven by exploitability, asset criticality, and whether the issue is already being used in the wild.
Detection, recovery, and compromise review
Detection should focus on suspicious application activity rather than the CVE label alone. After exploitation of a deserialization flaw, defenders may see unexpected outbound connections, new processes, file writes, web shell placement, or configuration changes that do not match normal application behaviour.
If the system was compromised, review what the application could access at the time of exploitation. Web application credentials, session material, API tokens, signing keys, and any adjacent service credentials may all need rotation if they were reachable from the affected process.
Post-patch review matters because fixing the vulnerable code does not prove the host was clean. Teams should verify whether attackers established persistence, whether they modified application files or scheduled tasks, and whether the compromise spread to adjacent systems through shared credentials or trust relationships.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE is a known exploited vulnerability requiring prioritised discovery and remediation. |
| Recommendation — Prioritise exposed Apache Struts instances for identification, remediation, and verification. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The term is about correcting a software flaw that attackers can exploit in production. |
| SI-10 — Information Input Validation | The vulnerability exists because untrusted input is being deserialized unsafely. | |
| SC-7 — Boundary Protection | Exposure depends heavily on whether the vulnerable application is reachable from untrusted networks. | |
| Recommendation — Apply flaw remediation controls to patch or mitigate the vulnerable Struts deployment quickly. Validate and constrain untrusted input before it reaches deserialization logic. Restrict external reachability to vulnerable application paths until fixed. | ||
| OWASP ASVS | V1 — Encoding and Sanitization | The flaw is triggered by unsafe handling of attacker-controlled data entering the application. |
| Recommendation — Harden input handling so untrusted data cannot reach dangerous deserialization paths. | ||
Practitioner Guidance
Why practitioners should care: Treat this class of issue as a remote execution problem first and a framework bug second. The operational priority is to remove the attacker path, confirm exposure, and determine whether the application handled any sensitive secrets or privileged sessions during the compromise window.
What to watch for: If an application uses serialized input in a reachable web path, assume that simple vulnerability scanning may miss the real risk unless it is paired with asset knowledge and behavioural detection. The presence of a CISA KEV listing means the question is no longer theoretical, it is a response and containment problem.
Related resources from NHI Mgmt Group
- CVE-2023-46604 (Apache ActiveMQ Deserialization of Untrusted Data)
- CVE-2021-45046 (Apache Log4j2 Deserialization of Untrusted Data)
- CVE-2026-20131 (Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data)
- CVE-2021-23758 (Ajax.NET Professional Deserialization of Untrusted Data)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org