CVE-2016-3081 in Apache Struts added to CISA's exploited vulnerabilities catalog

CISA added CVE-2016-3081 to its Known Exploited Vulnerabilities catalog on October 8, 2026. The RCE in Apache Struts 2.3.19–2.3.28 via a method: prefix works only when Dynamic Method Invocation is enabled, which is off by default; NVD scores it 8.1.

• CVE-2016-3081 was published in April 2016 and added to CISA's catalog on October 8, 2026
• Affected versions: Struts 2.3.19–2.3.20.2, 2.3.21–2.3.24.1 and 2.3.25–2.3.28
• Exploitation requires DMI to be enabled; NVD score is 8.1
• A fix has been available for about a decade, but legacy deployments remain exposed