Threat Advisories

CVE-2016-3081: Exploited Apache Struts RCE Puts PCI Scans at Risk

• 4 min read
CVE-2016-3081: Exploited Apache Struts RCE Puts PCI Scans at Risk

CVE-2016-3081 allows remote code execution in affected Apache Struts applications when Dynamic Method Invocation is enabled. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 8, 2026, and Halo Security Server Scanning is detecting it for customers. If you have an affected application, disable the vulnerable feature where possible and move to a supported Struts release.

What is CVE-2016-3081?

This is a command injection vulnerability in Apache Struts, a framework used to build Java web applications. A crafted request using the method: prefix can cause an affected application to execute attacker-controlled code when Dynamic Method Invocation, or DMI, is enabled. Apache documents the issue in security advisory S2-032 and credits Nike Zheng with reporting it.

The vulnerability was disclosed in 2016. Its age makes it easy to overlook in a backlog, but the new KEV listing gives teams a concrete reason to revisit remaining deployments.

What products and versions are affected?

The CVE Program record lists these affected Apache Struts ranges when DMI is enabled:

  • 2.3.19 through 2.3.20.2
  • 2.3.21 through 2.3.24.1
  • 2.3.25 through 2.3.28

Apache's advisory describes the range differently: 2.3.20 through 2.3.28, excluding 2.3.20.3 and 2.3.24.3. Review deployments covered by either published range, then confirm the deployed version and effective configuration with the application owner.

For packaged applications that include Struts, ask the product vendor for the supported update. Replacing a bundled library without checking compatibility can leave the application in an unsupported state.

How severe is it, and has it been exploited?

CISA's enrichment of the CVE record assigns a CVSS v3.1 score of 8.1, High, with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. That assessment describes a network attack requiring no privileges or user interaction, with high attack complexity and high potential impact on confidentiality, integrity, and availability.

The configuration requirement matters: finding an old Struts dependency is a reason to investigate, while confirming DMI is enabled establishes a key condition for this particular attack path.

CISA's KEV entry confirms exploitation in the wild. As of October 13, 2026, it lists ransomware use as unknown. Our guide to Known Exploited Vulnerabilities explains how that evidence should inform prioritization.

The catalog lists October 11, 2026 as its due date, which has already passed, and flags forensic triage under BOD 26-04. Covered federal agencies should determine and follow the applicable deadline for each asset under the directive. The catalog date is not a PCI scan deadline.

Why does this matter for PCI scans?

A valid finding on an asset within your PCI external scan scope needs attention. The PCI Security Standards Council explains that a passing external scan generally contains no vulnerabilities with a CVSS score of 4.0 or higher, and that remediation must be verified through rescanning. See PCI SSC's guidance on passing scans.

With its 8.1 score, CVE-2016-3081 is above that threshold. An applicable, unresolved finding can prevent a passing external scan. Work with your ASV to confirm the finding, remediate it, and document the rescan result. A Server Scanning finding alone is not a determination of your organization's overall PCI DSS compliance.

Are patches available?

Yes. Apache's original fixes were 2.3.20.3, 2.3.24.3, and 2.3.28.1. Those release numbers identify the historical fix for this CVE.

For current remediation, plan migration to a supported release. Apache lists Struts 2.3 as end of life, meaning that branch no longer receives security patches from the project. Disabling DMI addresses this vulnerability's trigger condition, but does not address other weaknesses in an obsolete deployment.

What should you do right now?

  1. Review the finding with the application owner. Confirm the affected endpoint, deployed Struts version, DMI configuration, internet exposure, and PCI scope. Record who owns the remediation. Before making changes, preserve relevant web, application, and host evidence where feasible. Coordinate evidence collection with urgent containment and remediation so avoidable evidence loss does not hinder the investigation.
  2. Disable DMI where possible. Follow Apache's S2-032 guidance and test affected application workflows. If that change cannot be made immediately, restrict access to the application while arranging the fix.
  3. Upgrade through a supported path. Test the release or vendor update against the application, then deploy it across every affected instance. Include standby instances and deployment images in the review so the vulnerable version is not restored later.
  4. Review for compromise. Review the preserved evidence and investigate suspicious requests, unexpected processes launched by the application, and unauthorized file changes. These are investigation leads, not CVE-specific proof of compromise.
  5. Rescan and retain evidence. Confirm remediation on the exposed service. For PCI-scoped findings, coordinate the required validation with your ASV and retain the results with the change record.

We recommend starting remediation immediately for an exposed, affected application. Assign a deadline and an owner even when a legacy dependency makes the upgrade difficult.

How Halo Security can help

Halo Security Server Scanning is detecting CVE-2016-3081 for customers. Review the finding with the team responsible for the application, address the underlying exposure, and verify the result after the change.

If the affected asset is in your PCI scan scope, bring the finding into your PCI compliance remediation workflow. Keep the technical fix and the scan validation together so the issue can be closed with evidence.

FAQ

Has CVE-2016-3081 been exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on October 8, 2026. The listing establishes known exploitation, but does not by itself establish when the attacks occurred or whether CISA is currently observing them. As of October 13, 2026, ransomware use is listed as unknown.

Does disabling Dynamic Method Invocation fix the problem?

Apache lists disabling Dynamic Method Invocation as a mitigation for CVE-2016-3081. An obsolete Struts deployment still needs a supported upgrade path to address other vulnerabilities.

Can this vulnerability cause a PCI scan failure?

Yes, an applicable, unresolved finding on an in-scope external asset can prevent a passing scan. Confirm the finding and required remediation evidence with your ASV, then rescan.

Does a Halo finding mean the application has been compromised?

No. A vulnerability finding identifies an issue to investigate and remediate. Determining whether an attacker has exploited it requires a separate review of the application and available evidence.

Close the finding with a verified fix

Start with the applications already flagged, assign an owner, and verify the remediation. If you need help organizing that work across your internet-facing assets, explore Halo Security's external vulnerability management.

Want to stay ahead of the newest CVEs and how they affect your attack surface? Halo Threat Intelligence tracks emerging vulnerabilities and scores their internet-facing exposure with our Surface Signal 1-5 rating.