Apache Struts 2: Remote code execution via Dynamic Method Invocation

Summary

Apache Struts 2 versions 2.3.20 to 2.3.28 allow remote attackers to execute arbitrary code on the server when Dynamic Method Invocation (DMI) is enabled. The flaw lies in how the framework handles chained expressions with the method: prefix, so a crafted request can be sent without authentication. Huawei products that embed Struts 2 are also affected. CISA lists the vulnerability as known exploited. The CPE data in the CVE record names Huawei Agile Controller-campus Firmware, but the sources identify Apache Struts 2 as the affected product, so asset matching needs verification.

Affected

• Apache Struts 2.3.20 to 2.3.28, except 2.3.20.3 and 2.3.24.3, when Dynamic Method Invocation is enabled (Apache advisory S2-032)
• The NVD description also lists 2.3.19 and up to 2.3.24.1 in the ranges; verify these versions manually
• Huawei products that embed Struts 2 (Huawei advisory huawei-sa-20160527-01); affected versions unknown

Fixed in

• Apache Struts 2.3.20.3
• Apache Struts 2.3.24.3
• Apache Struts 2.3.28.1
• Huawei products: unknown, request fixed versions from Huawei PSIRT

Workaround

• Disable Dynamic Method Invocation: set struts.enable.DynamicMethodInvocation to false in struts.xml and restart the web server
• Alternative (development task): implement a custom ActionMapper based on the source code of the fixed Struts versions

Exploitation

• CISA Known Exploited Vulnerabilities catalog: added 2026-10-08
• Public exploit available on Exploit-DB, and a Metasploit module exists
• No authentication required (PR:N); attack complexity high (AC:H); CISA SSVC: exploitation active, automatable no, technical impact total

Our recommendation

• Inventory all Struts 2 usage, including bundled components in vendor appliances and Huawei products
• Upgrade to Struts 2.3.20.3, 2.3.24.3 or 2.3.28.1, or disable Dynamic Method Invocation where possible
• For internet-facing systems, preserve logs and check for signs of compromise before patching, as recommended by CISA
• For embedded Huawei products, request fixed versions from Huawei PSIRT
• Monitor web server logs for requests containing method: expressions

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Metasploit module exploit/multi/http/struts_dmi_exec – Apache Struts Dynamic Method Invocation Remote Code Execution
• Exploit-DB EDB-ID 39756 – Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit) 2 May 2016

Research sources

• Apache Struts S2-032 Security Bulletin struts.apache.org
• Huawei PSIRT advisory huawei-sa-20160527-01-struts2-en www.huawei.com
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• NVD CVE-2016-3081 nvd.nist.gov
• Exploit-DB 39756 www.exploit-db.com
• Rapid7 Metasploit module struts_dmi_exec www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:43.