9.8 Critical Exploited

CVE-2020-17530 Apache Struts Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-917

Description

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Affected products and versions

Product	Affected versions	Fixed in
Apache Struts	Versions not published

References

cwiki.apache.org cwiki.apache.org
JVN#43969166 jvn.jp
www.oracle.com www.oracle.com
packetstormsecurity.com packetstormsecurity.com
security.netapp.com security.netapp.com
www.oracle.com www.oracle.com
www.oracle.com www.oracle.com
www.oracle.com www.oracle.com
www.oracle.com www.oracle.com
[oss-security] 20220412 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. www.openwall.com
www.oracle.com www.oracle.com

Timeline

Published December 11, 2020
Added to the KEV catalogue November 3, 2021
Last modified October 21, 2025

The 33 CVEs of Apache Struts →

CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache… Not rated CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin Not rated CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts Not rated CVE-2026-104711 Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')… Not rated

Track this CVE