Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-104711: Apache Struts legacy REST mapper allows remote code execution

CVE-2026-104711 · published 4 days ago

Summary

Versions of Apache Struts that use the old RESTful action mapper can be tricked by a specially crafted web request to run arbitrary code on the server. This risk exists in many older Struts releases unless the built‑in safety list is turned on. Upgrade to Struts 6.12.0 or 7.4.0, or switch to the newer action mapper, to eliminate the threat.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache struts	<= 2.3.37

Original advisory text

Apache Struts: OGNL injection in the legacy RESTful action mapper

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.

This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.

Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

References

https://repo.maven.apache.org/maven2 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-1047... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-104711 Vendor Advisory
https://cwiki.apache.org/confluence/display/WW/S2-075 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/05/10 URL

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Timeline

Published5 Oct 2026

Updated10 Oct 2026

First seen5 Oct 2026

Sources

CVE-2026-104711 · NVD

CVE-2026-104711 · MITRE

CVE-2026-104711 · OSV

Track software like this

Free during beta