CVE-2016-3081 (S2-032): Decade-Old Apache Struts Dynamic Method Invocation Flaw Still Being Exploited

Background

Apache Struts is a widely used open-source MVC framework for building Java web applications, long popular in enterprise environments including financial services, government, and logistics systems built on legacy Java stacks. One of its features, Dynamic Method Invocation (DMI), allowed a URL or form parameter to specify which action method to invoke at runtime using a method: prefix syntax — a convenience feature that was ultimately deprecated and disabled by default in later Struts releases precisely because of the security risk it introduced.

CVE-2016-3081, documented in the Struts security advisory S2-032, was originally disclosed in 2016. Its reappearance on CISA’s Known Exploited Vulnerabilities catalog a decade later is itself a notable data point: it indicates that unpatched or misconfigured legacy Struts deployments — or deployments where DMI was deliberately re-enabled for compatibility reasons — remain exposed and are being actively targeted in 2026, long after the original disclosure and patch were available.

Technical Mechanism

CVE-2016-3081 is a command injection vulnerability (CWE-77) that arises when Dynamic Method Invocation is enabled. Struts’ DMI feature evaluates a method: prefix on the action parameter to determine which method to invoke on the backing action class. Internally, Struts processes action-related expressions using OGNL (Object-Graph Navigation Language), the same expression language implicated in several of the framework’s other historically severe vulnerabilities.

The attack flow for CVE-2016-3081 follows this pattern:

1. An attacker identifies a Struts 2 application with Dynamic Method Invocation enabled (the default configuration in several affected releases).
2. The attacker crafts an HTTP request where the action parameter contains a method: prefix combined with a value that is not a legitimate method name, but is instead structured to be evaluated as an OGNL expression by the underlying parsing logic.
3. Because DMI resolution passes this value into OGNL evaluation without adequately restricting it to legitimate method-name resolution, the attacker-supplied expression is evaluated by the server.
4. OGNL in Struts 2 provides access to Java runtime capabilities; a successful injection allows the attacker to invoke Java’s process-execution APIs, resulting in arbitrary operating system command execution in the context of the application server process — all without any authentication.

This is architecturally the same class of weakness that produced other severe Struts OGNL-related vulnerabilities, including the 2017 flaw exploited in the Equifax breach (a distinct CVE, CVE-2017-5638, related to Content-Type header parsing rather than DMI — the two should not be conflated, though both ultimately root in unsafe OGNL evaluation of attacker-controlled input).

Real-World Exploitation Evidence

CVE-2016-3081 was added to CISA’s KEV catalog on 2026-10-08, with a remediation deadline of 2026-10-11. The fact that a 2016-disclosed vulnerability is receiving a fresh KEV addition a decade later is itself evidence that CISA has observed current, active exploitation — KEV additions reflect confirmed in-the-wild activity regardless of how old the underlying CVE is.

CISA’s data lists knownRansomwareCampaignUse as “Unknown” for this CVE, meaning no ransomware use has been confirmed by CISA at this time. No specific threat actor or campaign has been publicly attributed to this renewed exploitation activity in the data available for this analysis. It is worth noting, without attributing it to this specific campaign, that Struts OGNL-related command injection flaws have historically attracted both opportunistic commodity scanning and more targeted intrusion activity once weaponized, given how reliably they yield unauthenticated remote code execution.

Impact Assessment

Successful exploitation yields arbitrary operating system command execution in the context of the Struts application server process, with no authentication required:

• Full web application compromise: An attacker gains the ability to run arbitrary commands with whatever privileges the application server process holds, typically sufficient to read application source, configuration files (including database credentials), and session data.
• Backend pivot risk: Enterprise Struts deployments frequently sit in front of databases and internal services; command execution on the app server is commonly a stepping stone to those backend systems.
• Legacy-system risk concentration: Because this vulnerability specifically affects deployments still running Dynamic Method Invocation — a deprecated, security-sensitive feature — affected organizations are disproportionately likely to be running otherwise-unmaintained legacy Java applications, which often also lack modern logging, WAF coverage, or patch management discipline.

Sector-specific risk: Financial services, government, and logistics organizations with long-lived Java application estates are historically the heaviest users of Struts and are therefore the most likely to still have DMI-enabled legacy deployments in production, often supporting business-critical but infrequently touched applications.

Affected Versions

The original S2-032 advisory identifies the following affected range:

Organizations should confirm their exact version and DMI configuration state against Apache’s S2-032 advisory, as some later Struts versions ship with DMI disabled by default but can still be vulnerable if administrators have explicitly re-enabled it for legacy compatibility.

Remediation Steps

1. Upgrade to a currently supported Apache Struts version rather than relying solely on the original 2016-era patch, since Struts 2.3.x itself is long past end-of-life.
2. Explicitly disable Dynamic Method Invocation regardless of version, as defense in depth:

# struts.xml or struts.properties
struts.enable.DynamicMethodInvocation = false

3. Audit action configuration for any explicit method: usage patterns that may depend on DMI being enabled, and migrate those to explicit action mappings before disabling DMI in production.
4. Inventory all Struts 2 deployments across the organization — legacy framework versions are easy to lose track of in large or decentralized Java estates, and this CVE specifically threatens exactly those forgotten deployments.
5. Place a WAF or reverse proxy in front of any Struts application that cannot be immediately upgraded, with rules blocking method: prefixed action parameters containing OGNL-characteristic syntax (%{, #, nested parentheses) as an interim compensating control.

Detection Guidance

• Web server/WAF log review: Search access logs for action parameters containing the method: prefix combined with OGNL-characteristic special characters such as %25, #, (, or ) — a strong indicator of attempted exploitation.
• Application server process monitoring: Monitor for unexpected child processes spawned by the Java process hosting the Struts application (e.g., sh, bash, cmd.exe, or unusual binaries), which would indicate successful command injection following OGNL evaluation.
• Outbound connection anomalies: Watch for outbound connections initiated by the application server host that are inconsistent with its normal function, a common post-exploitation step (reverse shells, payload downloads).
• Vendor/IDS signatures: Exact Snort/Suricata or WAF rule content should be sourced from your security vendor’s current signature feed, since publicly available rules for this vulnerability class have existed since 2016 and should already be present in most mature IDS rule sets — verify they remain enabled and up to date.

Timeline

References

• Apache Struts — S2-032 Security Advisory
• CISA — BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2016-3081