CVE-2016-3087: Apache Struts 2 REST Plugin RCE via Dynamic Method Invocation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS score of 9.8, public exploit availability, and high EPSS probability indicate an urgent need for patching and mitigation.

What it is

Apache Struts versions 2.3.19 through 2.3.28, when Dynamic Method Invocation is enabled, fail to properly validate input passed through an exclamation mark operator to the REST Plugin. This allows remote attackers to execute arbitrary code on the server. The flaw is critical because it requires no authentication or user interaction and can lead to full system compromise.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the application server, potentially leading to complete host takeover, data theft, or lateral movement.

Attack surface

The vulnerability is reachable over the network via HTTP requests to the Struts REST Plugin when Dynamic Method Invocation is enabled. No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Exploit code is publicly available on Exploit-DB, and EPSS indicates a high probability of exploitation (0.81873, 99.63rd percentile). The CVE is not listed in CISA KEV, but the presence of a public exploit and high EPSS score suggest active exploitation is likely.

What to do

• Upgrade to a non-vulnerable version of Apache Struts (2.3.29 or later) as per the vendor advisory S2-033.
• Disable Dynamic Method Invocation if it is not required for the application.
• Apply input validation and filtering to block exclamation mark operators in REST Plugin requests.
• Monitor for and restrict access to the REST Plugin endpoints if not needed.
• Review and harden server configurations to limit the impact of remote code execution.

Detection

• Monitor HTTP requests for exclamation mark characters in URLs targeting Struts REST endpoints.
• Inspect application logs for unexpected method invocations or errors related to the REST Plugin.
• Use network intrusion detection systems to detect known exploit patterns for CVE-2016-3087.
• Audit server processes for unusual child processes or command executions originating from the web server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.