Huawei Anyoffice vulnerabilities

3 CVEs affecting Huawei Anyoffice, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22439, published 2021-06-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3081: Apache Struts Command Injection Vulnerability, published 2016-04-26. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 96.1% chance of exploitation in the next 30 days. Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to…
CVE-2016-8275, published 2017-04-02. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb.
CVE-2021-22439, published 2021-06-29. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the…