CVE-2017-9791 Apache Struts 1 Improper Input Validation Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-20

Description

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Affected products and versions

Product	Affected versions	Fixed in
Apache Struts	Versions not published

Other CVEs of Apache Struts

The 33 CVEs of Apache Struts →

CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache… Not rated CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin Not rated CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts Not rated CVE-2026-104711 Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')… Not rated