CVE-2012-0391: Apache Struts ExceptionDelegator OGNL injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 3.1 score of 9.8, KEV listing, high EPSS, and public exploit code make this an urgent patch target.

What it is

Apache Struts before 2.2.3.1 evaluates parameter values as OGNL expressions in the ExceptionDelegator component during exception handling for mismatched property data types. A crafted parameter therefore reaches the OGNL evaluator and can execute arbitrary Java code. This is a remotely reachable, unauthenticated code execution flaw in a widely deployed web framework.

Impact

An attacker can execute arbitrary Java code in the context of the Struts application, leading to full compromise of the affected server and any data or credentials it can reach.

Attack surface

Reached over the network through HTTP requests to a Struts application; the CVSS vector shows no privileges and no user interaction required. Any exposed endpoint that triggers the ExceptionDelegator path with a crafted parameter is a candidate.

Exploitation

CVE-2012-0391 is listed in CISA KEV with a 2022-01-21 addition date, and EPSS reports a 30-day probability of about 0.756 (99.5th percentile). Multiple references are tagged Exploit, including Exploit-DB 18329, so public exploit code exists.

What to do

• Upgrade Apache Struts to 2.2.3.1 or later, or to a currently supported Struts release.
• If immediate upgrade is not possible, apply the vendor guidance in S2-008 and restrict or filter parameters that reach exception-handling paths.
• Place affected applications behind a WAF or reverse proxy with rules blocking OGNL expression patterns in request parameters.
• Remove or isolate internet exposure of legacy Struts applications that cannot be patched.
• Verify no residual vulnerable Struts libraries remain in packaged WAR/EAR artifacts after remediation.

Detection

• Search web and application logs for requests containing OGNL syntax such as %{, #, or java.lang in parameter values.
• Monitor for unexpected child processes or outbound connections spawned by the Java application server.
• Alert on exploitation attempts against known Struts endpoints using signatures for CVE-2012-0391 and related S2-008 patterns.
• Inventory hosts and application artifacts for Struts versions below 2.2.3.1.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.