{"id":"CVE-2016-3081","title":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.","summary":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-77"],"vendor":"huawei","product":"anyoffice","affected":["agile_controller-campus_firmware = v100r002c00","anyoffice = v200r005c00","anyoffice = v200r006c00","logcenter = v100r001c10","logcenter = v100r001c20","firehunter6000_firmware = v100r001c20","oceanstor_5300_v3_firmware = v300r001","oceanstor_5300_v3_firmware = v300r002","oceanstor_5300_v3_firmware = v300r003c00","oceanstor_5300_v3_firmware = v300r003c10","oceanstor_5500_v3_firmware = v300r001","oceanstor_5500_v3_firmware = v300r002","oceanstor_5500_v3_firmware = v300r003c00","oceanstor_5500_v3_firmware = v300r003c10","oceanstor_5600_v3_firmware = v300r001","oceanstor_5600_v3_firmware = v300r002","oceanstor_5600_v3_firmware = v300r003c00","oceanstor_5600_v3_firmware = v300r003c10","oceanstor_5800_v3_firmware = v300r001","oceanstor_5800_v3_firmware = v300r002","oceanstor_5800_v3_firmware = v300r003c00","oceanstor_5800_v3_firmware = v300r003c10","oceanstor_6800_v3_firmware = v300r001","oceanstor_6800_v3_firmware = v300r002","oceanstor_6800_v3_firmware = v300r003c00","oceanstor_6800_v3_firmware = v300r003c10","oceanstor_18500_v3_firmware = v300r001","oceanstor_18500_v3_firmware = v300r002","oceanstor_18500_v3_firmware = v300r003c00","oceanstor_18500_v3_firmware = v300r003c10","oceanstor_18500f_firmware = v300r001","oceanstor_18500f_firmware = v300r002","oceanstor_18500f_firmware = v300r003c00","oceanstor_18500f_firmware = v300r003c10","oceanstor_18800_v3_firmware = v300r001","oceanstor_18800_v3_firmware = v300r002","oceanstor_18800_v3_firmware = v300r003c00","oceanstor_18800_v3_firmware = v300r003c10","oceanstor_18800f_firmware = v300r001","oceanstor_18800f_firmware = v300r002","oceanstor_18800f_firmware = v300r003c00","oceanstor_18800f_firmware = v300r003c10","oceanstor_9000_firmware = v100r001c01","oceanstor_9000_firmware = v100r001c30","oceanstor_9000_firmware = v300r005c00","oceanstor_n8500_firmware = v200r001c09spc505","oceanstor_n8500_firmware = v200r001c91spc205","oceanstor_n8500_firmware = v200r001c91spc900","oceanstor_n8500_firmware = v200r001c91spc901","oceanstor_onebox_firmware = v100r003c10","struts >= 2.3.20, < 2.3.20.3","struts >= 2.3.21, < 2.3.24.3","struts >= 2.3.25, < 2.3.28.1","flexcube_private_banking = 2.0.0.0","flexcube_private_banking = 2.0.1","flexcube_private_banking = 2.2.0","flexcube_private_banking = 12.0.1","flexcube_private_banking = 12.0.3","flexcube_private_banking = 12.1.0","micros_retail_xbri_loss_prevention = 10.0.1","micros_retail_xbri_loss_prevention = 10.5.0","micros_retail_xbri_loss_prevention = 10.6.0","micros_retail_xbri_loss_prevention = 10.7.0","micros_retail_xbri_loss_prevention = 10.8.0","micros_retail_xbri_loss_prevention = 10.8.1","siebel_e-billing = 7.1"],"patched":["struts 2.3.28.1"],"published":"2016-04-26","updated":"2026-10-09","sourceUpdated":"2026-10-09T14:43:05.703","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-3081","references":[{"url":"http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html","label":"secalert@redhat.com"},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en","label":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","label":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","label":"secalert@redhat.com"},{"url":"http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec","label":"secalert@redhat.com"},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec","label":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/87327","label":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/91787","label":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1035665","label":"secalert@redhat.com"},{"url":"https://struts.apache.org/docs/s2-032.html","label":"secalert@redhat.com"},{"url":"https://www.exploit-db.com/exploits/39756/","label":"secalert@redhat.com"},{"url":"http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/87327","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/91787","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1035665","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://struts.apache.org/docs/s2-032.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/39756/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available","cve.org"],"epss":0.96052,"epssPercentile":0.99877,"kev":true,"kevDateAdded":"2026-10-08","kevDueDate":"2026-10-11","kevRansomware":false,"exploited":true,"exploits":{"exploitdb":true,"metasploit":["exploit/multi/http/struts_dmi_exec"],"nuclei":["CVE-2016-3081"],"checkedAt":"2026-10-11T14:25:53.736Z"},"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-10-08T17:40:07.972437Z"},"ingestedAt":"2026-10-08T17:56:11.730Z","slug":"CVE-2016-3081","body":"## Overview\n\nApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.\n\n## Affected\n\n- `agile_controller-campus_firmware = v100r002c00`\n- `anyoffice = v200r005c00`\n- `anyoffice = v200r006c00`\n- `logcenter = v100r001c10`\n- `logcenter = v100r001c20`\n- `firehunter6000_firmware = v100r001c20`\n- `oceanstor_5300_v3_firmware = v300r001`\n- `oceanstor_5300_v3_firmware = v300r002`\n- `oceanstor_5300_v3_firmware = v300r003c00`\n- `oceanstor_5300_v3_firmware = v300r003c10`\n- `oceanstor_5500_v3_firmware = v300r001`\n- `oceanstor_5500_v3_firmware = v300r002`\n- `oceanstor_5500_v3_firmware = v300r003c00`\n- `oceanstor_5500_v3_firmware = v300r003c10`\n- `oceanstor_5600_v3_firmware = v300r001`\n- `oceanstor_5600_v3_firmware = v300r002`\n- `oceanstor_5600_v3_firmware = v300r003c00`\n- `oceanstor_5600_v3_firmware = v300r003c10`\n- `oceanstor_5800_v3_firmware = v300r001`\n- `oceanstor_5800_v3_firmware = v300r002`\n- `oceanstor_5800_v3_firmware = v300r003c00`\n- `oceanstor_5800_v3_firmware = v300r003c10`\n- `oceanstor_6800_v3_firmware = v300r001`\n- `oceanstor_6800_v3_firmware = v300r002`\n- `oceanstor_6800_v3_firmware = v300r003c00`\n- `oceanstor_6800_v3_firmware = v300r003c10`\n- `oceanstor_18500_v3_firmware = v300r001`\n- `oceanstor_18500_v3_firmware = v300r002`\n- `oceanstor_18500_v3_firmware = v300r003c00`\n- `oceanstor_18500_v3_firmware = v300r003c10`\n- `oceanstor_18500f_firmware = v300r001`\n- `oceanstor_18500f_firmware = v300r002`\n- `oceanstor_18500f_firmware = v300r003c00`\n- `oceanstor_18500f_firmware = v300r003c10`\n- `oceanstor_18800_v3_firmware = v300r001`\n- `oceanstor_18800_v3_firmware = v300r002`\n- `oceanstor_18800_v3_firmware = v300r003c00`\n- `oceanstor_18800_v3_firmware = v300r003c10`\n- `oceanstor_18800f_firmware = v300r001`\n- `oceanstor_18800f_firmware = v300r002`\n- `oceanstor_18800f_firmware = v300r003c00`\n- `oceanstor_18800f_firmware = v300r003c10`\n- `oceanstor_9000_firmware = v100r001c01`\n- `oceanstor_9000_firmware = v100r001c30`\n- `oceanstor_9000_firmware = v300r005c00`\n- `oceanstor_n8500_firmware = v200r001c09spc505`\n- `oceanstor_n8500_firmware = v200r001c91spc205`\n- `oceanstor_n8500_firmware = v200r001c91spc900`\n- `oceanstor_n8500_firmware = v200r001c91spc901`\n- `oceanstor_onebox_firmware = v100r003c10`\n- `struts >= 2.3.20, < 2.3.20.3`\n- `struts >= 2.3.21, < 2.3.24.3`\n- `struts >= 2.3.25, < 2.3.28.1`\n- `flexcube_private_banking = 2.0.0.0`\n- `flexcube_private_banking = 2.0.1`\n- `flexcube_private_banking = 2.2.0`\n- `flexcube_private_banking = 12.0.1`\n- `flexcube_private_banking = 12.0.3`\n- `flexcube_private_banking = 12.1.0`\n- `micros_retail_xbri_loss_prevention = 10.0.1`\n- `micros_retail_xbri_loss_prevention = 10.5.0`\n- `micros_retail_xbri_loss_prevention = 10.6.0`\n- `micros_retail_xbri_loss_prevention = 10.7.0`\n- `micros_retail_xbri_loss_prevention = 10.8.0`\n- `micros_retail_xbri_loss_prevention = 10.8.1`\n- `siebel_e-billing = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `struts 2.3.28.1`","depth":"abyssal","depthScore":89,"depthScoreParts":{"impact":44.6,"likelihood":19.2,"exploitation":25,"ransomware":0},"changes":[{"seq":218368,"id":"CVE-2016-3081","ts":1791519895406,"field":"kev","old":"false","new":"true"}]}