SMB Owners: Address Apache Struts Vulnerability Before October 11

What is the Apache Struts Command Injection Vulnerability?

Apache Struts is a framework used to build web applications. It helps developers manage user input and generate dynamic web pages. The vulnerability, known as CVE-2016-3081, allows attackers to inject and run arbitrary commands on a server. This means an attacker could take control of your system, access sensitive data, or install malware.

This flaw was discovered in 2016 and patched at that time. However, CISA recently added it to their Known Exploited Vulnerabilities (KEV) list on October 8, 2026, indicating it is now being actively exploited in real-world attacks. If your business is still using an unpatched version of Struts, you're at risk.

The vulnerability is triggered when a user submits specially crafted input through a web form or URL. If your web application is using Struts and hasn't been updated, attackers can exploit this to execute malicious code on your server.

Is This Vulnerability a Risk for SMBs?

Yes. Many SMBs use Apache Struts to build internal tools, customer-facing websites, or APIs that connect to other systems. If your company is using an older version of Struts and hasn't upgraded, you're vulnerable.

Attackers are actively exploiting this flaw in real-world attacks. That means if you're running an outdated Struts-based application, your business could be compromised. The risk is real and growing.

Even if you're not aware of using Struts, it's possible that a third-party application or service you rely on is using it. For example, if you use a custom CRM or a content management system (CMS) built on Struts, you're at risk. You should verify if any of your web applications are using Struts and if they're up to date.

What Should You Do This Week?

1. **Check if you're using Apache Struts.** Review your web applications and any custom software you use. If you're unsure, ask your IT team or service provider.

2. **Update to a patched version.** If you're using Struts, ensure it's updated to a version that's not vulnerable. The latest versions of Struts are secure and available from Apache.

3. **Verify third-party tools.** If you're using any third-party applications or services that rely on Struts, contact the vendor and confirm they've patched the vulnerability.

4. **Review logs for signs of exploitation.** Look for unusual commands, unexpected user activity, or access from unknown sources. If you see anything suspicious, investigate immediately.

5. **Act by October 11.** Federal guidance requires remediation by October 11, 2026. Delaying could result in compliance violations and increased risk of exploitation.

How Can You Tell if You've Already Been Hit?

Detecting exploitation can be tricky, but there are a few signs to look for. First, check your server logs for unexpected commands or unusual user input. If you see commands like 'dir' or 'whoami' in your logs, that could be a sign of exploitation.

Also look for unauthorized access to sensitive files or directories. If files have been modified or deleted without explanation, that could be a red flag.

Another indicator is unexpected behavior from your web application. If pages are loading slowly, or if users are being redirected to strange websites, that could be a sign of compromise.

If you suspect a breach, isolate the affected system immediately and contact a cybersecurity professional. Don't wait—attacks can spread quickly and cause serious damage.

Not sure whether your environment is exposed? That is exactly what our Web Application Penetration Testing service is built to surface. Talk to us.

Frequently asked questions

Source (public domain): CISA