Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-104711 EUVD-2026-92622GHSA-wfm5-pq4p-gff9

Apache Struts: OGNL injection in the legacy RESTful action mapper

Published Oct 5, 2026 · Updated Oct 6, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Struts

Description

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.

This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.

Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Struts 2.0.0 – ≤ 2.3.37, 2.5.0 – ≤ 2.5.33, 6.0.0 – ≤ 6.11.0, 7.0.0 – ≤ 7.3.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • fixedbyreboot/CVE-2026-104711-POC ★ 2 · Nov 10, 2026

    POC exploit for CVE-2026-104711 - OGNL injection RCE in Apache Struts legacy REST action mapper (S2-075). Vulnerable vs fixed verification included.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References