09 October 2026
Reference: CVE-2016-3081
1. What is being reported?
The vulnerability affects certain versions of Apache Struts, a software framework used to build web applications. When a specific feature called Dynamic Method Invocation is turned on, attackers can exploit this flaw to run malicious code on the affected system without permission.
2. What this means in plain English
If your organisation uses Apache Struts with this feature enabled, attackers could take control of your web applications remotely. This could lead to data theft, disruption of services, or other harmful impacts. Small organisations relying on this software should be aware of the risk and act quickly.
3. Could this affect a small business?
Small businesses or charities using Apache Struts versions listed as vulnerable and with Dynamic Method Invocation enabled could be affected. Those not using this software or using updated, patched versions are unlikely to be at risk. If unsure, check with your IT provider.
4. What to do now
- Contact your IT provider or software supplier to confirm if your systems use Apache Struts and if the vulnerable versions are in use.
- Ensure that any Apache Struts software is updated or patched according to the vendor’s instructions to fix this vulnerability.
- If updates or patches are not available, follow recommended mitigations or consider discontinuing use of the affected software.
- Review your internet exposure and security measures to reduce the risk of exploitation, following official guidance on prioritising security updates.
5. Ask your IT provider
Can you confirm if our systems use Apache Struts with Dynamic Method Invocation enabled, and have we applied the latest security updates to protect against CVE-2016-3081?
6. Bottom line
If you use Apache Struts, act now to update or mitigate this serious vulnerability to protect your organisation from cyber attacks.
Information based on CISA KEV, NVD, and reputable security reporting.