CVE-2017-12611: Apache Struts Freemarker tag expression flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and full confidentiality, integrity and availability impact, combined with a very high EPSS score and an exploit-tagged vendor advisory.

What it is

Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1 mishandle expressions used in Freemarker tags in place of string literals, allowing unintended expression evaluation. Because that evaluation can reach code execution, the flaw is a critical remote code execution issue in a widely deployed web framework.

Impact

An attacker can execute arbitrary code in the context of the Struts application, leading to full compromise of the affected server and any data or credentials it can reach.

Attack surface

Reachable over the network through HTTP requests to a Struts application that uses Freemarker tags with non-literal expressions; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

The vendor advisory is tagged Exploit, and EPSS is very high at 0.87123 (99.74th percentile), though the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Upgrade Apache Struts to a version above 2.5.10.1 (or above 2.3.33 on the 2.3 branch) per the vendor S2-053 advisory
• If immediate upgrade is not possible, apply the mitigations referenced by third-party advisories such as Aruba and Oracle
• Audit Struts applications for Freemarker tags that use expressions instead of string literals and convert them to literals
• Restrict network exposure of Struts applications and place them behind filtering or a WAF where feasible
• Verify patched status for bundled Struts in third-party products such as NetApp and Oracle offerings

Detection

• Inspect web and application logs for requests containing Freemarker expression syntax or unusual template payloads targeting Struts endpoints
• Monitor for unexpected child processes or command execution spawned by the Java application server
• Alert on outbound network connections from the Struts host that are not part of normal application behavior
• Scan deployed artifacts and dependency manifests for Struts versions in the affected ranges

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.