The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2016-3081, a decade-old Apache Struts remote code execution vulnerability, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The flaw affects Apache Struts installations where Dynamic Method Invocation is enabled and can allow a remote attacker to execute arbitrary code through the method: prefix. Affected versions include Apache Struts 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28.

The agency instructed organizations to apply mitigations based on vendor guidance and follow Binding Operational Directive 26-04, which prioritizes security updates based on risk. Security teams should review web-server logs, Struts application logs, process activity, outbound network connections, newly created accounts, scheduled tasks, web shells, and unauthorized changes to application directories.

Although CISA’s entry does not explicitly state ransomware use for this vulnerability, attackers frequently exploit remote code execution flaws in public-facing frameworks as initial-access opportunities. Defenders should treat exploitation attempts as potential intrusions, especially when the affected application hosts sensitive data or has privileged access to internal infrastructure.