CVE-2016-3087: Apache Struts

Critical severity, CVSS 9.8. EPSS: 81.9% chance of exploitation in the next 30 days.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

Affected products

• Apache Struts: version 2.3.20 only; version 2.3.20.1 only; version 2.3.24 only; version 2.3.24.1 only; version 2.3.28 only

Published 2016-06-07. Last modified 2026-06-17.