Apache Struts security vulnerabilities
Developer framework / library. Public CVE monitoring for Apache Struts. Vendor security advisories are linked on this page.
Built for Operators of this product.
25 public records · 0 security-fix timeline events. 0 published in the last 7 days. 14 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-08-060 issues2026-11-03
Known exploited
View all known exploited- High8.1Apache Struts Command Injection VulnerabilityPatch nowKEVEPSS 96.53%Apr 26, 2016
- High8.1Apache Struts Improper Restriction of XML External Entity ReferencePatch nowKEVEPSS 50.42%Jan 11, 2026
- Critical9.3Apache Struts Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 70.21%Jul 16, 2013
- High7.5Apache Struts 1 ActionForm Denial-of-Service VulnerabilityPatch nowKEVEPSS 54.63%Mar 30, 2006
- Critical9.8Apache Struts Remote Code Execution VulnerabilityPatch nowKEVEPSS 100.00%Mar 10, 2017
- High8.1Apache Struts Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 99.40%Sep 15, 2017
- Critical9.8Apache Struts 2 Improper Input Validation VulnerabilityPatch nowKEVEPSS 75.60%Jan 8, 2012
- Critical9.8Apache Struts Remote Code Execution VulnerabilityPatch nowKEVEPSS 96.25%Dec 10, 2020
Recently published
Browse catalog- High8.1Apache Struts Improper Restriction of XML External Entity ReferencePatch nowKEVEPSS 50.42%Jan 11, 2026
- High8.2Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.Check if you run itEPSS 0.59%Dec 10, 2025
- High7.5Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.Check if you run itEPSS 1.53%Dec 1, 2025
- Critical9.8ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability.Check if you run itEPSS 0.80%Oct 14, 2025
- Medium6.5** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.Check if you run itEPSS 0.67%Jul 30, 2025
- Critical9.8Apache Struts Remote Code Execution VulnerabilityPatch nowKEVEPSS 96.25%Dec 10, 2020
- High8.1Apache Struts Remote Code Execution VulnerabilityPatch nowKEVEPSS 100.00%Aug 22, 2018
- High8.1Apache Struts Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 99.40%Sep 15, 2017
- Critical9.8Apache Struts 1 Improper Input Validation VulnerabilityPatch nowKEVEPSS 98.91%Jul 10, 2017
- Critical9.8Apache Struts Remote Code Execution VulnerabilityPatch nowKEVEPSS 100.00%Mar 10, 2017