What it is
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
What to do
Apply updates per vendor instructions.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Apache entries on the list
- Struts Apache Struts Command Injection Vulnerability CVE-2016-3081 · Oct 8, 2026
- Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CVE-2026-34486 · Aug 4, 2026
- ActiveMQ Apache ActiveMQ Improper Input Validation Vulnerability CVE-2026-34197 · Apr 16, 2026
- HTTP Server Apache HTTP Server Improper Escaping of Output Vulnerability CVE-2024-38475 · May 1, 2025
- Tomcat Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813 · Apr 1, 2025
- OFBiz Apache OFBiz Forced Browsing Vulnerability CVE-2024-45195 · Feb 4, 2025