CVE-2021-31805: Apache Struts 2 tag attribute double OGNL evaluation RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction remote code execution and a very high EPSS score make this an urgent patch target despite no KEV listing.

What it is

The fix for CVE-2020-17530 was incomplete: in Apache Struts 2.0.0 through 2.5.29, certain tag attributes still perform a double evaluation when a developer forces OGNL evaluation with the %{...} syntax. If that forced evaluation is applied to untrusted user input, the injected expression is evaluated a second time, allowing remote code execution. This matters because it is a network-reachable, unauthenticated flaw in a widely deployed Java web framework.

Impact

An attacker can execute arbitrary code in the context of the Struts application, leading to full compromise of confidentiality, integrity and availability of the affected server.

Attack surface

Reached over the network via HTTP requests that supply input to a Struts tag attribute using forced %{...} OGNL evaluation; the CVSS vector indicates no authentication and no user interaction are required. Exploitation depends on the application actually passing untrusted input into such a forced-evaluation attribute.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.854, 99.7th percentile), and vendor and third-party references provide patch and mitigation guidance.

What to do

• Upgrade Apache Struts to a version later than 2.5.29 that contains the complete fix for S2-062.
• If immediate upgrade is not possible, apply the mitigation guidance in the Apache S2-062 advisory and the oss-security posting.
• Remove or avoid forced OGNL evaluation (%{...}) on any tag attribute that can receive untrusted user input.
• Audit application code and third-party Struts components for tag attributes that evaluate user-controlled values.
• Track vendor advisories (NetApp, Oracle) for affected bundled products and patch accordingly.

Detection

• Search web and application logs for requests containing OGNL expression syntax such as %{...} or ${...} in parameters reaching Struts tag attributes.
• Monitor for unexpected child processes or command execution spawned by the Java/Struts application server.
• Deploy WAF or IDS signatures for known Struts OGNL injection patterns and alert on matches.
• Review application code and runtime behavior for tag attributes that double-evaluate user input.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.