{"schema_version":"1","data":[{"id":2990,"advisory_id":"ce03dc7a-bbb8-4aa4-b51b-9dbc90290c63","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-11776","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:27:09.746206+00:00","extraction_method":"structured","technologies":["core-kev","struts"],"cve_ids":["CVE-2018-11776"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Struts Remote Code Execution Vulnerability","summary":"Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2018-11776","products":[{"name":{"value":"Struts","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-11776","aliases":["CVE-2018-11776"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2018-11776","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-11776","dueDate":"2022-05-03","product":"Struts","dateAdded":"2021-11-03","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.","vulnerabilityName":"Apache Struts Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2018-11776","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2989,"advisory_id":"f9379bf6-1ffa-4458-bc7e-ce9bbfa07013","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-5638","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:27:09.150209+00:00","extraction_method":"structured","technologies":["core-kev","struts"],"cve_ids":["CVE-2017-5638"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Struts Remote Code Execution Vulnerability","summary":"Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-5638","products":[{"name":{"value":"Struts","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-5638","aliases":["CVE-2017-5638"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2017-5638","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-5638","dueDate":"2022-05-03","product":"Struts","dateAdded":"2021-11-03","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.","vulnerabilityName":"Apache Struts Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2017-5638","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2987,"advisory_id":"d4302d01-7da3-4ce5-9342-e5bc020fd816","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-17530","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:27:08.039819+00:00","extraction_method":"structured","technologies":["core-kev","struts"],"cve_ids":["CVE-2020-17530"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Struts Remote Code Execution Vulnerability","summary":"Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-17530","products":[{"name":{"value":"Struts","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-17530","aliases":["CVE-2020-17530"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-917"],"cveID":"CVE-2020-17530","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-17530","dueDate":"2022-05-03","product":"Struts","dateAdded":"2021-11-03","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.","vulnerabilityName":"Apache Struts Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-17530","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2982,"advisory_id":"144e5911-7b92-4c70-9788-64170b11438b","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-9805","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:27:05.12815+00:00","extraction_method":"structured","technologies":["core-kev","struts"],"cve_ids":["CVE-2017-9805"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Struts Deserialization of Untrusted Data Vulnerability","summary":"Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-9805","products":[{"name":{"value":"Struts","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-9805","aliases":["CVE-2017-9805"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2017-9805","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-9805","dueDate":"2022-05-03","product":"Struts","dateAdded":"2021-11-03","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.","vulnerabilityName":"Apache Struts Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2017-9805","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2742,"advisory_id":"7220c783-1dd9-4312-afdc-0f912acd3764","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-2251","source_published_at":"2022-03-25T00:00:00+00:00","published_at":"2026-10-24T21:23:46.195712+00:00","extraction_method":"structured","technologies":["core-kev","struts"],"cve_ids":["CVE-2013-2251"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Struts Improper Input Validation Vulnerability","summary":"Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2013-2251","products":[{"name":{"value":"Struts","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2013-2251","aliases":["CVE-2013-2251"],"affected":[],"modified":"2022-03-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2013-2251","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-2251","dueDate":"2022-04-15","product":"Struts","dateAdded":"2022-03-25","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.","vulnerabilityName":"Apache Struts Improper Input Validation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2013-2251","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":19,"advisory_id":"b732327f-bccb-42f2-9233-4f72979ded38","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081","source_published_at":"2026-10-08T00:00:00+00:00","published_at":"2026-10-24T20:39:31.927217+00:00","extraction_method":"structured","technologies":["core-kev","struts"],"cve_ids":["CVE-2016-3081"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Struts Command Injection Vulnerability","summary":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2016-3081","products":[{"name":{"value":"Struts","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-3081","aliases":["CVE-2016-3081"],"affected":[],"modified":"2026-10-08T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-77"],"cveID":"CVE-2016-3081","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cwiki.apache.org/confluence/display/WW/S2-032 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2016-3081","dueDate":"2026-10-11","product":"Struts","dateAdded":"2026-10-08","vendorProject":"Apache","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","vulnerabilityName":"Apache Struts Command Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-3081","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}}],"next_after":2990,"next_before":19}