CVE-2020-17530: Apache Struts forced OGNL evaluation enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8, KEV listing, and near-maximum EPSS probability makes this an urgent patch target.

What it is

Apache Struts 2.0.0 through 2.5.25 performs forced OGNL evaluation on raw user input placed in tag attributes, allowing expression language injection. Because the injected expression is evaluated server-side, an unauthenticated remote attacker can execute arbitrary code on the application server.

Impact

An attacker gains remote code execution with the privileges of the Struts application, which typically means full control of the host and any data or credentials it can reach.

Attack surface

Reachable over the network via HTTP requests to a Struts application that passes raw user input into tag attributes; the CVSS vector shows no privileges or user interaction required.

Exploitation

CVE-2020-17530 is listed in CISA KEV with a 2021-11-03 addition date, and EPSS gives a 30-day exploitation probability of 0.95931 (99.872 percentile), indicating active exploitation is expected.

What to do

• Upgrade Apache Struts to a version later than 2.5.25 per the S2-061 vendor advisory.
• Apply the Oracle CPU patches for affected Oracle products that embed Struts (Business Intelligence, Communications products, Financial Services Data Integration Hub, Hospitality Opera 5, MySQL Enterprise Monitor).
• If immediate upgrade is not possible, avoid passing raw user input into Struts tag attributes and apply the input validation guidance in S2-061.
• Treat any internet-facing Struts 2.0.0-2.5.25 instance as compromised until proven otherwise and review it for webshells and unexpected processes.

Detection

• Search web and application logs for OGNL metacharacters such as %{, ${, and # in request parameters and tag attribute values.
• Monitor for child processes spawned by the Java/Struts application server (for example shell, curl, or wget) as a sign of post-exploitation.
• Hunt for newly written JSP, WAR, or class files in web-accessible directories and for outbound connections from the application host.
• Alert on exploitation attempts against known Struts endpoints using the public S2-061 proof-of-concept patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.