AI analysis
Claude Opus · 5 Nov 2026, 10:21 CET
Apache Struts flaw lets remote attackers run code when Dynamic Method Invocation is on
Apache Struts 2.3.x applications with Dynamic Method Invocation enabled can be taken over remotely without authentication. CISA lists this flaw as exploited. Upgrade Struts, apply the Huawei and Oracle product fixes, and disable Dynamic Method Invocation.
In plain terms
Apache Struts is a widely used framework for building Java web applications. Some older 2.3.x releases contain a flaw that lets an attacker who can reach the web application run their own commands on the server, with no login required. This only happens when an optional feature called Dynamic Method Invocation is switched on. Dynamic Method Invocation lets a web request choose which piece of application code to run.
The flaw also affects commercial products that bundle Struts. The record lists Huawei storage, security and network management products and several Oracle applications. Anyone running a custom Struts 2.3.x application, or one of these vendor products, should check whether they are exposed. This is especially urgent for systems reachable from the internet, because the flaw is confirmed as exploited.