Apache Struts Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 08/10/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.struts:struts2-core | ≥ 2.3.19, < 2.3.20.3≥ 2.3.21, < 2.3.24.3≥ 2.3.25, < 2.3.28.1 | 2.3.20.32.3.24.32.3.28.1 |
| struts | ≥ 2.3.20, < 2.3.20.3≥ 2.3.21, < 2.3.24.3≥ 2.3.25, < 2.3.28.1 | 2.3.20.32.3.24.32.3.28.1 |
| anyoffice | = v200r005c00= v200r006c00 | |
| logcenter | = v100r001c10= v100r001c20 | |
| flexcube private banking | = 12.0.1= 12.0.3= 12.1.0= 2.0.0.0= 2.0.1= 2.2.0 | |
| micros retail xbri loss prevention | = 10.0.1= 10.5.0= 10.6.0= 10.7.0= 10.8.0= 10.8.1 | |
| siebel e-billing | = 7.1 |
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free