Apache Struts: OGNL injection in legacy RESTful action mapper
Summary
Apache Struts applications configured to use the legacy RESTful action mapper are affected by an expression language injection (CWE-917). A crafted, unauthenticated HTTP request can inject an OGNL expression, which may lead to remote code execution with the privileges of the application. Struts 7 is affected only when the OGNL allowlist is disabled, which is not the default. Applications using the default action mapper, the restful2 mapper or the Struts REST plugin are not affected.
Affected
- Apache Struts 2.0.0 through 2.3.37 (end-of-life)
- Apache Struts 2.5.0 through 2.5.33 (end-of-life)
- Apache Struts 6.0.0 through 6.11.0
- Apache Struts 7.0.0 through 7.3.0, only with the OGNL allowlist disabled
- Only if the legacy RESTful action mapper is configured
Fixed in
- Apache Struts 7.4.0 or later
- Apache Struts 6.12.0 or later (6.x line)
- Apache Struts 2.x: no fix, end-of-life; migration required
Workaround
- Switch to the default action mapper, the restful2 mapper or the Struts REST plugin instead of the legacy RESTful action mapper
- On Struts 7, keep the OGNL allowlist enabled
- Check configuration for the legacy mapper class (RestfulActionMapper)
Exploitation
- No reports of in-the-wild exploitation or public proof-of-concept found in the reviewed sources
- CISA KEV status not verified
- EPSS 0.01191 (Vulners)
- CISA SSVC: automatable yes, technical impact total
Our recommendation
- Inventory all Struts applications and their versions and action mapper configuration (for example struts2-core in build files or WAR files)
- Prioritise internet-facing applications that use the legacy mapper
- Upgrade to 7.4.0 or 6.12.0 as soon as possible
- Plan a migration away from Struts 2.x, or obtain extended support
- If patching is delayed, switch away from the legacy mapper
- Review logs for unusual requests to Struts endpoints and investigate possible compromise of exposed, unpatched systems
- Note the discrepancy between Apache's rating (Moderate) and the CVSS 9.8 score used for prioritisation
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache S2-075 security bulletin cwiki.apache.org
- oss-security mailing list post www.openwall.com
- OSV record CVE-2026-104711 osv.dev
- Vulners vulnrichment CVE-2026-104711 vulners.com
- Apache Struts project home struts.apache.org
- SentinelOne vulnerability database CVE-2026-104711 www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:15.
Original description (NVD)
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.