CVE-2018-11776: Apache Struts namespace handling flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw allows unauthenticated remote code execution, is listed in CISA KEV, has public exploits, and shows an EPSS probability near 1.0.

What it is

Apache Struts 2.3 through 2.3.34 and 2.5 through 2.5.16 can execute remote code when alwaysSelectFullNamespace is enabled and results or url tags are used without a namespace while the upper package has no or a wildcard namespace. This is a well-known, widely exploited Struts flaw that allows unauthenticated attackers to run code on the server.

Impact

An attacker can execute arbitrary code with the privileges of the Struts application, leading to full server compromise, data theft, or use as a foothold for lateral movement.

Attack surface

Reachable over the network via HTTP requests to a vulnerable Struts application; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).

Exploitation

Exploitation is confirmed: CVE-2018-11776 is in CISA KEV (added 2021-11-03) and has public exploit references (ExploitDB, GitHub PoC) with an EPSS 30-day probability of 0.99991.

What to do

• Upgrade Apache Struts to a fixed version (2.3.35 or later in the 2.3 line, or 2.5.17 or later in the 2.5 line) as directed by the vendor.
• If immediate upgrade is not possible, disable alwaysSelectFullNamespace or ensure all result and url tag usages specify explicit namespaces and avoid wildcard or empty namespaces in upper packages.
• Apply vendor patches for affected Oracle, NetApp, and other products that bundle Struts.
• Restrict network access to Struts applications to trusted sources where feasible.
• Monitor for and block known exploit patterns targeting Struts namespace handling.

Detection

• Inspect HTTP requests for suspicious OGNL expressions or namespace manipulation in URLs targeting Struts actions.
• Monitor application and web server logs for unexpected command execution, outbound connections, or child processes spawned by the Java process.
• Use IDS/IPS signatures or WAF rules that detect CVE-2018-11776 exploit attempts.
• Audit deployed Struts versions and configurations to identify instances with alwaysSelectFullNamespace enabled and vulnerable namespace setups.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.