Old Apache Struts flaw actively exploited in attacks, CISA says
java
dev.to
CISA added Apache Struts command injection flaw CVE-2016-3081 to its Known Exploited Vulnerabilities catalog under BOD 26-04. The issue affects Struts versions 2.3.19 through 2.3.28 when Dynamic Method Invocation is enabled, allowing remote command execution. Organizations running affected releases are advised to upgrade to fixed versions or disable DMI while conducting forensic triage for prior unauthorized access. The issue concerns the Apache Struts software and allows unknown parties t