CyberSIXT Search
Apache product

Struts

← All Apache products

No CISA KEV deadline is open. CISA last added a Struts CVE on 8 Oct.

Tracked since 15 Aug · latest article Sun 11 Oct · RSS

Added to KEV · 90 days
1
of 9 in the full CISA catalogue · all time
High exploit odds · current
0
EPSS top 5%, not in KEV
Articles · 7 days
0
none this week

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2016-3081Struts8 OctDeadline passed 11 Oct5 articles
CVE-2013-2251not in CyberSIXT coverageStruts25 Mar 2022Deadline passed 15 Apr 2022
CVE-2017-9791not in CyberSIXT coverageStruts 110 Feb 2022Deadline passed 10 Aug 2022
CVE-2006-1547not in CyberSIXT coverageStruts 121 Jan 2022Deadline passed 21 Jul 2022
CVE-2012-0391not in CyberSIXT coverageStruts 221 Jan 2022Deadline passed 21 Jul 2022
CVE-2017-5638Struts3 Nov 2021Deadline passed 3 May 2022Known ransomware use · 1 article
CVE-2017-9805not in CyberSIXT coverageStruts3 Nov 2021Deadline passed 3 May 2022
CVE-2018-11776not in CyberSIXT coverageStruts3 Nov 2021Deadline passed 3 May 2022
CVE-2020-17530not in CyberSIXT coverageStruts3 Nov 2021Deadline passed 3 May 2022

Coverage

8 articles · all timeFull timeline

8 articles from 5 outlets since 15 Aug; the latest 15 days ago.

Struts: coverage over time8 articles from 5 outlets. First report 15 Aug by SecurityOnline. Busiest week: 7 articles, week of 5 Oct. 0 in the last 7 days. Struts: coverage over time8 articles from 5 outlets. First report 15 Aug by SecurityOnline. Busiest week: 7 articles, week of 5 Oct. 0 in the last 7 days.
  • Article
  • First report
  • Official notice
Show as table
Struts: articles
Published (UTC)OutletHeadline
Sun 11 Oct · 10:01 UTCSecurity AffairsCISA Flags Five Exploited Flaws in China Linked Cyber Campaign
Fri 9 Oct · 12:50 UTCThe Hacker NewsCISA Adds Five Flaws to KEV After Flax Typhoon Attacks
Fri 9 Oct · 07:31 UTCSecurityOnlineCISA Flags Five Actively Exploited Flaws in Enterprise Tools
Thu 8 Oct · 19:02 UTCCISACISA Flags Actively Exploited Apache Struts Flaw for Urgent Patching
Thu 8 Oct · 18:48 UTCThe Hacker NewsChina-Based Hackers Accused of Stealing Emails Across 7 Countries
Mon 5 Oct · 15:35 UTCSecurityOnlineApache Struts fixes four flaws, including remote code execution risk
Mon 5 Oct · 12:07 UTCSOCRadarDark Web Claims Expose 10 Million French Records and More
Sat 15 Aug · 15:00 UTCSecurityOnlineApache patches five Struts 2 bugs, warns of remote DoS and leaks

Who reported 5 outlets, last 12 months

  • SecurityOnline3
  • The Hacker News2
  • SOCRadar1
  • CISA1
  • Security Affairs1
  1. CISA Flags Five Exploited Flaws in China Linked Cyber CampaignSecurity Affairs
  2. CISA Adds Five Flaws to KEV After Flax Typhoon AttacksThe Hacker News
  3. CISA Flags Five Actively Exploited Flaws in Enterprise ToolsSecurityOnline
  4. CISA Flags Actively Exploited Apache Struts Flaw for Urgent PatchingCISA · official notice
  5. China-Based Hackers Accused of Stealing Emails Across 7 CountriesThe Hacker News
  6. Apache Struts fixes four flaws, including remote code execution riskSecurityOnline
  7. Dark Web Claims Expose 10 Million French Records and MoreSOCRadar
  8. Apache patches five Struts 2 bugs, warns of remote DoS and leaksSecurityOnline

All CVEs in coverage

11
CVE-2017-5638Apache Struts Remote Code Execution VulnerabilityCVSS9.8CriticalExploited99.9%EPSS1article
CVE-2016-3081Apache Struts Command Injection VulnerabilityCVSS8.1HighExploited97%EPSS5articles
CVE-2026-104711Apache Struts: OGNL injection in the legacy RESTful action mapperCVSSUnrated–Not in KEV1.4%EPSS1article
CVE-2026-104712Apache Struts: Disproportionate response size when rendering BigDecimal request parametersCVSSUnrated–Not in KEV0.8%EPSS1article
CVE-2026-73633Apache Struts: Unbounded read of a JSON request bodyCVSS7.5High–Not in KEV0.7%EPSS1article
CVE-2026-104713Apache Struts: Unbounded request body read in the REST pluginCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-104714Apache Struts: Shared message formatter exposes date and time values across concurrent requestsCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request localeCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-73634Apache Struts: Unbounded read of a Content Security Policy violation reportCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-73631Apache Struts: Shared parsing state in the JSON pluginCVSS4.3Medium–Not in KEV0.4%EPSS1article
CVE-2026-73632Apache Struts: Shared serialization state in the JSON pluginCVSS4.3Medium–Not in KEV0.4%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device