CVE-2026-0089
CriticalRemote Code Execution in Apache Struts 2.x
Description
A critical security vulnerability has been identified in Apache Struts versions 2.0.0 through 2.5.30. This vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the target server by sending a malformed HTTP request containing a malicious OGNL expression in the header. This vulnerability arises from improper validation of untrusted input in the multipart parser. Successful exploitation grants the attacker full control over the compromised server (`system` or `root` privileges in many cases).
Affected Software
- Apache Struts 2.0.0 - 2.5.30
- Apache Struts 6.0.0 - 6.0.3
Remediation
Upgrade to Apache Struts 2.5.31 or 6.1.0 immediately. If upgrading is not possible, implement the recommended WAF rules to block malicious OGNL payloads.
CVSS Score
Common Vulnerability Scoring System
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H