{"cve":"CVE-2016-3081","nvd":{"published":"2016-04-26T14:59:02.207","modified":"2026-10-09T14:43:05.703","status":"Analyzed","description":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-77"],"references":["http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec"],"products":["apache:struts","huawei:agile_controller-campus_firmware","huawei:anyoffice","huawei:firehunter6000_firmware","huawei:logcenter","huawei:oceanstor_18500_v3_firmware","huawei:oceanstor_18500f_firmware","huawei:oceanstor_18800_v3_firmware","huawei:oceanstor_18800f_firmware","huawei:oceanstor_5300_v3_firmware","huawei:oceanstor_5500_v3_firmware","huawei:oceanstor_5600_v3_firmware","huawei:oceanstor_5800_v3_firmware","huawei:oceanstor_6800_v3_firmware","huawei:oceanstor_9000_firmware","huawei:oceanstor_n8500_firmware","huawei:oceanstor_onebox_firmware","oracle:flexcube_private_banking","oracle:micros_retail_xbri_loss_prevention","oracle:siebel_e-billing"],"source":"nvd","synced_at":"2026-10-19T20:38:51.654415212+00:00"},"epss":{"cve":"CVE-2016-3081","score":0.96525,"percentile":0.99881,"date":"2026-10-25"},"kev":{"cve":"CVE-2016-3081","date_added":"2026-10-08","due_date":"2026-10-11","vendor":"Apache","product":"Struts","known_ransomware":false},"osv":[{"id":"GHSA-8c6j-ffmf-q6vm","url":"https://osv.dev/vulnerability/GHSA-8c6j-ffmf-q6vm","summary":"Apache Struts RCE Vulnerability","modified":"2024-02-16T08:16:46.290501Z","packages":[{"ecosystem":"Maven","name":"org.apache.struts:struts2-core","purl":"pkg:maven/org.apache.struts/struts2-core","ranges":[">=2.3.19 <2.3.20.3"],"fixed":["2.3.20.3"]},{"ecosystem":"Maven","name":"org.apache.struts:struts2-core","purl":"pkg:maven/org.apache.struts/struts2-core","ranges":[">=2.3.21 <2.3.24.3"],"fixed":["2.3.24.3"]},{"ecosystem":"Maven","name":"org.apache.struts:struts2-core","purl":"pkg:maven/org.apache.struts/struts2-core","ranges":[">=2.3.25 <2.3.28.1"],"fixed":["2.3.28.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}