--- id: CVE-2016-3081 title: >- Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. summary: >- Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-77 vendor: huawei product: anyoffice affected: - agile_controller-campus_firmware = v100r002c00 - anyoffice = v200r005c00 - anyoffice = v200r006c00 - logcenter = v100r001c10 - logcenter = v100r001c20 - firehunter6000_firmware = v100r001c20 - oceanstor_5300_v3_firmware = v300r001 - oceanstor_5300_v3_firmware = v300r002 - oceanstor_5300_v3_firmware = v300r003c00 - oceanstor_5300_v3_firmware = v300r003c10 - oceanstor_5500_v3_firmware = v300r001 - oceanstor_5500_v3_firmware = v300r002 - oceanstor_5500_v3_firmware = v300r003c00 - oceanstor_5500_v3_firmware = v300r003c10 - oceanstor_5600_v3_firmware = v300r001 - oceanstor_5600_v3_firmware = v300r002 - oceanstor_5600_v3_firmware = v300r003c00 - oceanstor_5600_v3_firmware = v300r003c10 - oceanstor_5800_v3_firmware = v300r001 - oceanstor_5800_v3_firmware = v300r002 - oceanstor_5800_v3_firmware = v300r003c00 - oceanstor_5800_v3_firmware = v300r003c10 - oceanstor_6800_v3_firmware = v300r001 - oceanstor_6800_v3_firmware = v300r002 - oceanstor_6800_v3_firmware = v300r003c00 - oceanstor_6800_v3_firmware = v300r003c10 - oceanstor_18500_v3_firmware = v300r001 - oceanstor_18500_v3_firmware = v300r002 - oceanstor_18500_v3_firmware = v300r003c00 - oceanstor_18500_v3_firmware = v300r003c10 - oceanstor_18500f_firmware = v300r001 - oceanstor_18500f_firmware = v300r002 - oceanstor_18500f_firmware = v300r003c00 - oceanstor_18500f_firmware = v300r003c10 - oceanstor_18800_v3_firmware = v300r001 - oceanstor_18800_v3_firmware = v300r002 - oceanstor_18800_v3_firmware = v300r003c00 - oceanstor_18800_v3_firmware = v300r003c10 - oceanstor_18800f_firmware = v300r001 - oceanstor_18800f_firmware = v300r002 - oceanstor_18800f_firmware = v300r003c00 - oceanstor_18800f_firmware = v300r003c10 - oceanstor_9000_firmware = v100r001c01 - oceanstor_9000_firmware = v100r001c30 - oceanstor_9000_firmware = v300r005c00 - oceanstor_n8500_firmware = v200r001c09spc505 - oceanstor_n8500_firmware = v200r001c91spc205 - oceanstor_n8500_firmware = v200r001c91spc900 - oceanstor_n8500_firmware = v200r001c91spc901 - oceanstor_onebox_firmware = v100r003c10 - 'struts >= 2.3.20, < 2.3.20.3' - 'struts >= 2.3.21, < 2.3.24.3' - 'struts >= 2.3.25, < 2.3.28.1' - flexcube_private_banking = 2.0.0.0 - flexcube_private_banking = 2.0.1 - flexcube_private_banking = 2.2.0 - flexcube_private_banking = 12.0.1 - flexcube_private_banking = 12.0.3 - flexcube_private_banking = 12.1.0 - micros_retail_xbri_loss_prevention = 10.0.1 - micros_retail_xbri_loss_prevention = 10.5.0 - micros_retail_xbri_loss_prevention = 10.6.0 - micros_retail_xbri_loss_prevention = 10.7.0 - micros_retail_xbri_loss_prevention = 10.8.0 - micros_retail_xbri_loss_prevention = 10.8.1 - siebel_e-billing = 7.1 patched: - struts 2.3.28.1 published: '2016-04-26' updated: '2026-10-09' sourceUpdated: '2026-10-09T14:43:05.703' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2016-3081' references: - url: >- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html label: secalert@redhat.com - url: >- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en label: secalert@redhat.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html label: secalert@redhat.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html label: secalert@redhat.com - url: 'http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec' label: secalert@redhat.com - url: 'http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec' label: secalert@redhat.com - url: 'http://www.securityfocus.com/bid/87327' label: secalert@redhat.com - url: 'http://www.securityfocus.com/bid/91787' label: secalert@redhat.com - url: 'http://www.securitytracker.com/id/1035665' label: secalert@redhat.com - url: 'https://struts.apache.org/docs/s2-032.html' label: secalert@redhat.com - url: 'https://www.exploit-db.com/exploits/39756/' label: secalert@redhat.com - url: >- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/87327' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/91787' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1035665' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://struts.apache.org/docs/s2-032.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.exploit-db.com/exploits/39756/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 tags: - nvd - kev - in-the-wild - exploit-available - cve.org epss: 0.96052 epssPercentile: 0.99877 kev: true kevDateAdded: '2026-10-08' kevDueDate: '2026-10-11' kevRansomware: false exploited: true exploits: exploitdb: true metasploit: - exploit/multi/http/struts_dmi_exec nuclei: - CVE-2016-3081 checkedAt: '2026-10-11T14:25:53.736Z' exploitAvailable: true ssvc: exploitation: active automatable: 'no' technicalImpact: total timestamp: '2026-10-08T17:40:07.972437Z' ingestedAt: '2026-10-08T17:56:11.730Z' --- ## Overview Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. ## Affected - `agile_controller-campus_firmware = v100r002c00` - `anyoffice = v200r005c00` - `anyoffice = v200r006c00` - `logcenter = v100r001c10` - `logcenter = v100r001c20` - `firehunter6000_firmware = v100r001c20` - `oceanstor_5300_v3_firmware = v300r001` - `oceanstor_5300_v3_firmware = v300r002` - `oceanstor_5300_v3_firmware = v300r003c00` - `oceanstor_5300_v3_firmware = v300r003c10` - `oceanstor_5500_v3_firmware = v300r001` - `oceanstor_5500_v3_firmware = v300r002` - `oceanstor_5500_v3_firmware = v300r003c00` - `oceanstor_5500_v3_firmware = v300r003c10` - `oceanstor_5600_v3_firmware = v300r001` - `oceanstor_5600_v3_firmware = v300r002` - `oceanstor_5600_v3_firmware = v300r003c00` - `oceanstor_5600_v3_firmware = v300r003c10` - `oceanstor_5800_v3_firmware = v300r001` - `oceanstor_5800_v3_firmware = v300r002` - `oceanstor_5800_v3_firmware = v300r003c00` - `oceanstor_5800_v3_firmware = v300r003c10` - `oceanstor_6800_v3_firmware = v300r001` - `oceanstor_6800_v3_firmware = v300r002` - `oceanstor_6800_v3_firmware = v300r003c00` - `oceanstor_6800_v3_firmware = v300r003c10` - `oceanstor_18500_v3_firmware = v300r001` - `oceanstor_18500_v3_firmware = v300r002` - `oceanstor_18500_v3_firmware = v300r003c00` - `oceanstor_18500_v3_firmware = v300r003c10` - `oceanstor_18500f_firmware = v300r001` - `oceanstor_18500f_firmware = v300r002` - `oceanstor_18500f_firmware = v300r003c00` - `oceanstor_18500f_firmware = v300r003c10` - `oceanstor_18800_v3_firmware = v300r001` - `oceanstor_18800_v3_firmware = v300r002` - `oceanstor_18800_v3_firmware = v300r003c00` - `oceanstor_18800_v3_firmware = v300r003c10` - `oceanstor_18800f_firmware = v300r001` - `oceanstor_18800f_firmware = v300r002` - `oceanstor_18800f_firmware = v300r003c00` - `oceanstor_18800f_firmware = v300r003c10` - `oceanstor_9000_firmware = v100r001c01` - `oceanstor_9000_firmware = v100r001c30` - `oceanstor_9000_firmware = v300r005c00` - `oceanstor_n8500_firmware = v200r001c09spc505` - `oceanstor_n8500_firmware = v200r001c91spc205` - `oceanstor_n8500_firmware = v200r001c91spc900` - `oceanstor_n8500_firmware = v200r001c91spc901` - `oceanstor_onebox_firmware = v100r003c10` - `struts >= 2.3.20, < 2.3.20.3` - `struts >= 2.3.21, < 2.3.24.3` - `struts >= 2.3.25, < 2.3.28.1` - `flexcube_private_banking = 2.0.0.0` - `flexcube_private_banking = 2.0.1` - `flexcube_private_banking = 2.2.0` - `flexcube_private_banking = 12.0.1` - `flexcube_private_banking = 12.0.3` - `flexcube_private_banking = 12.1.0` - `micros_retail_xbri_loss_prevention = 10.0.1` - `micros_retail_xbri_loss_prevention = 10.5.0` - `micros_retail_xbri_loss_prevention = 10.6.0` - `micros_retail_xbri_loss_prevention = 10.7.0` - `micros_retail_xbri_loss_prevention = 10.8.0` - `micros_retail_xbri_loss_prevention = 10.8.1` - `siebel_e-billing = 7.1` ## Remediation Upgrade past the affected range: - `struts 2.3.28.1`