Back to CVE records
High 8.1Known exploited (CISA KEV)Published Apr 26, 2016
CVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to…
Updated under an hour ago ()
Does this affect you?
It affects huawei agile_controller-campus_firmware and 19 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Oct 8, 2026; federal agencies had to remediate by Oct 11, 2026. Treat that date as your deadline.
Do this next
Start free and add your stack
Free account, 1 product
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
- CVSS
- 8.1 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-77
- Known exploited
- Added to CISA KEV Oct 8, 2026; federal remediation due Oct 11, 2026Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- EPSS (exploitation in the next 30 days)
- 96.05% (percentile 100)
- Assigned by
- redhat
- NVD analysis
- Analyzed
- Record last updated
- Oct 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
huawei agile_controller-campus_firmware huawei:agile_controller-campus_firmware | v100r002c00 | NVD |
huawei anyoffice huawei:anyoffice | v200r005c00; v200r006c00 | NVD |
huawei logcenter huawei:logcenter | v100r001c10; v100r001c20 | NVD |
huawei firehunter6000_firmware huawei:firehunter6000_firmware | v100r001c20 | NVD |
huawei oceanstor_5300_v3_firmware huawei:oceanstor_5300_v3_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_5500_v3_firmware huawei:oceanstor_5500_v3_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_5600_v3_firmware huawei:oceanstor_5600_v3_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_5800_v3_firmware huawei:oceanstor_5800_v3_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_6800_v3_firmware huawei:oceanstor_6800_v3_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_18500_v3_firmware huawei:oceanstor_18500_v3_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_18500f_firmware huawei:oceanstor_18500f_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_18800_v3_firmware huawei:oceanstor_18800_v3_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_18800f_firmware huawei:oceanstor_18800f_firmware | v300r001; v300r002; v300r003c00; v300r003c10 | NVD |
huawei oceanstor_9000_firmware huawei:oceanstor_9000_firmware | v100r001c01; v100r001c30; v300r005c00 | NVD |
huawei oceanstor_n8500_firmware huawei:oceanstor_n8500_firmware | v200r001c09spc505; v200r001c91spc205; v200r001c91spc900; v200r001c91spc901 | NVD |
huawei oceanstor_onebox_firmware huawei:oceanstor_onebox_firmware | v100r003c10 | NVD |
apache struts apache:struts | from 2.3.20 before 2.3.20.3; from 2.3.21 before 2.3.24.3; from 2.3.25 before 2.3.28.1 | NVD |
oracle flexcube_private_banking oracle:flexcube_private_banking | 2.0.0.0; 2.0.1; 2.2.0; 12.0.1; 12.0.3; 12.1.0 | NVD |
oracle micros_retail_xbri_loss_prevention oracle:micros_retail_xbri_loss_prevention | 10.0.1; 10.5.0; 10.6.0; 10.7.0; 10.8.0; 10.8.1 | NVD |
oracle siebel_e-billing oracle:siebel_e-billing | 7.1 | NVD |
References
- http://www.securitytracker.com/id/1035665vdb-entry, x-refsource-sectrack
- https://struts.apache.org/docs/s2-032.htmlx-refsource-confirm
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-enx-refsource-confirm
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlx-refsource-confirm
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlx-refsource-confirm
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_execx-refsource-misc
- https://www.exploit-db.com/exploits/39756/exploit, x-refsource-exploit-db
- http://www.securityfocus.com/bid/91787vdb-entry, x-refsource-bid
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.htmlx-refsource-misc
- http://www.securityfocus.com/bid/87327vdb-entry, x-refsource-bid
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_execx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.