8.1 High Exploited

CVE-2018-11776 Apache Struts Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-20

Description

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Affected products and versions

Product	Affected versions	Fixed in
Apache Struts	Versions not published

References

1041888 www.securitytracker.com
45367 www.exploit-db.com
45262 www.exploit-db.com
105125 www.securityfocus.com
1041547 www.securitytracker.com
45260 www.exploit-db.com
[announce] 20200131 Apache Software Foundation Security Report: 2019 lists.apache.org
www.oracle.com www.oracle.com
www.oracle.com www.oracle.com
www.oracle.com www.oracle.com
security.netapp.com security.netapp.com
cwiki.apache.org cwiki.apache.org
psirt.global.sonicwall.com psirt.global.sonicwall.com
www.oracle.com www.oracle.com
lgtm.com lgtm.com
security.netapp.com security.netapp.com
www.arubanetworks.com www.arubanetworks.com
github.com github.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published August 22, 2018
Added to the KEV catalogue November 3, 2021
Last modified October 21, 2025

The 33 CVEs of Apache Struts →

CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache… Not rated CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin Not rated CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts Not rated CVE-2026-104711 Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')… Not rated

Track this CVE