CVE-2017-9791: Apache Struts 1 plugin input validation flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: medium.

critical priorityCVSS 9.8, CISA KEV listing, and near-maximum EPSS probability indicate active exploitation risk with unauthenticated remote code execution.

What it is

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x may allow remote code execution when a malicious field value is passed in a raw message to the ActionMessage. The flaw is improper input validation (CWE-20), and because it can be reached over the network without credentials, it is a serious risk to any exposed Struts 1 plugin deployment.

Impact

An unauthenticated remote attacker can potentially execute arbitrary code on the affected server, leading to full compromise of the application and host.

Attack surface

Reachable over the network via HTTP requests that supply a crafted field value in a raw ActionMessage; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

CVE-2017-9791 is listed in CISA KEV (added 2022-02-10) and has a very high EPSS 30-day probability of 0.98908 (percentile 0.99926); public exploit references exist on Exploit-DB, though no ransomware campaign use is documented.

What to do

• Apply the vendor patch or upgrade per the Apache Struts S2-048 advisory and any applicable third-party patches (for example Oracle's alert).
• If the Struts 1 plugin is not required, remove or disable it to eliminate the attack surface.
• Restrict network access to Struts endpoints to trusted sources and place them behind a WAF or reverse proxy with input filtering.
• Monitor for and block requests containing suspicious raw ActionMessage field values or known exploit patterns.
• Verify no remaining 2.1.x or 2.3.x Struts 1 plugin instances are exposed and track remediation against the CISA KEV due date.

Detection

• Search web and application logs for requests to Struts actions containing unusual or encoded field values in ActionMessage parameters.
• Alert on outbound network connections or process creation from the web server process that are inconsistent with normal application behavior.
• Use the Exploit-DB proof-of-concept patterns (42324, 44643) to build IDS/WAF signatures and test detection coverage.
• Inventory hosts running Apache Struts 2.1.x/2.3.x with the Struts 1 plugin and confirm patch status.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.