CVE-2016-3087
CriticalPublic exploitApache Struts vulnerable to arbitrary remote code execution due to improper input validation
Published May 14, 2022 · Updated Jul 8, 2026 · Also known as GHSA-mmj6-cjj4-hpr5
Key Facts
Patch immediately- CVE-2016-3087 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Struts (Apache), org.apache.struts:struts2-core (maven).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including org.apache.struts:struts2-core 2.3.20.3, org.apache.struts:struts2-core 2.3.24.3, org.apache.struts:struts2-core 2.3.28.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2016-3087 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Affected Products
6 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| StrutsApache | 2.3.20, 2.3.20.1, 2.3.24, 2.3.24.1, 2.3.28 | n/a |
| org.apache.struts:struts2-coremaven | >= 2.3.19 | 2.3.28.1 |
Patched Releases
org.apache.struts:struts2-core
2.3.20.3, 2.3.24.3, 2.3.28.1
Timeline
Publicly disclosed
May 14, 2022
Last updated
Jul 8, 2026
Weakness Type
- CWE-20 Improper Input Validation
References
- advisoryGHSA advisory
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2016-3087
- advisory39919
- exploitMSF struts_dmi_rest_exec.rb
- exploitExploitDB-39919
FAQ
Common Questions.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an !
Affected: Struts (Apache) versions 2.3.20, 2.3.20.1, 2.3.24, 2.3.24.1, 2.3.28; org.apache.struts:struts2-core (maven) versions >= 2.3.19. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including org.apache.struts:struts2-core 2.3.20.3, org.apache.struts:struts2-core 2.3.24.3, org.apache.struts:struts2-core 2.3.28.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2016-3087 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo