Unpacking CVE-2026 — Impact, Detection, and Remediation

Unpacking CVE-2026

CVE-2026-4201 exposes Apache Struts applications to remote code execution (RCE). This critical vulnerability stems from improper input validation within the Struts framework's OGNL expression evaluation. An unauthenticated attacker can execute arbitrary operating system commands on affected servers.

The Common Vulnerability Scoring System (CVSS) v3.1 rates CVE-2026-4201 with a base score of 9.8, classifying it as Critical. This high score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. Successful exploitation grants complete control over the compromised server.

Affected versions include Apache Struts 2.5.0 through 2.5.30, and 2.6.0 through 2.6.5. Versions 2.5.31 and 2.6.6 contain the necessary patches. Organizations running any of the vulnerable versions must prioritize immediate remediation. The Apache Struts Security Bulletin S2-070 details the official advisory.

Technical root cause analysis

The vulnerability lies within the Struts "Text" component, specifically how it processes certain parameters. Under specific configurations, user-supplied input intended for message resource bundles can bypass security restrictions. This allows direct injection of malicious Object-Graph Navigation Language (OGNL) expressions.

Struts uses OGNL for flexible data access and manipulation within its framework. The flaw occurs when an attacker crafts a request that forces the framework to interpret user-controlled data as an OGNL expression, rather than a literal string. This happens even before action method invocation in some cases.

The underlying issue is a lack of strict context enforcement during OGNL evaluation. The framework fails to sufficiently sanitize or restrict input passed to methods that eventually process OGNL. This creates a dangerous gateway for expression language injection.

Exploitation mechanics

Exploiting CVE-2026-4201 involves sending a specially crafted HTTP request to a vulnerable Struts application. The attacker injects OGNL expressions into specific HTTP parameters or headers. These expressions then execute arbitrary Java code or OS commands on the server.

A common exploitation vector involves manipulating HTTP headers like Content-Type or other request parameters. The injected OGNL expression then leverages Java's reflection API to execute system commands. This bypasses typical input validation mechanisms because the injection occurs at a deeper level within the framework's processing.

For example, an attacker could inject an OGNL expression to invoke java.lang.Runtime.getRuntime().exec(). This allows the execution of arbitrary commands, such as downloading and running a malicious payload or establishing a reverse shell. The technical detail without weaponization focuses on the expression structure that triggers the OGNL evaluation.

A simplified example of a problematic OGNL fragment, stripped of full exploit context, might look like this:

#context['xwork.MethodAccessor.denyMethodExecution']=false,
#[email protected]@EMPTY_SET,
#cmd='id',
#p=new java.lang.ProcessBuilder(#cmd),
#p.redirectErrorStream(true),
#process=#p.start(),
#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()),
#is=new java.io.InputStreamReader(#process.getInputStream()),
#br=new java.io.BufferedReader(#is),
#br.readLine(),
#ros.close()

This OGNL snippet demonstrates how an attacker can manipulate context, disable method execution restrictions, and then execute a system command (id in this case). The output of the command is then streamed back to the attacker via the HTTP response. This illustrates the core mechanism of the RCE.

Detection: how to check if you're affected

Organizations must identify all instances of Apache Struts running within their infrastructure. Begin by enumerating web servers and applications. Check application configurations and libraries for Struts dependencies. A technology stack detector can help identify frameworks in use.

Examine the pom.xml (for Maven projects) or build.gradle (for Gradle projects) files in your application's source code. Look for entries like org.apache.struts:struts2-core and note the version number. Any version between 2.5.0 and 2.5.30, or 2.6.0 and 2.6.5, is vulnerable.

Manually inspect deployed WAR/EAR files if source code is unavailable. Decompress the archive and check the META-INF/maven/org.apache.struts/struts2-core/pom.properties file. This file often contains the exact Struts version.

Utilize automated scanning tools. A free website vulnerability scanner can often detect known Struts vulnerabilities, including CVE-2026-4201, by analyzing HTTP responses and application behavior. For broader coverage, a CMS vulnerability scanner can also assist, even if Struts is a framework rather than a full CMS.

Consider internet-wide scanning with platforms like Zondex. This can help identify publicly exposed Struts applications that might be vulnerable. Regularly scheduled vulnerability assessments are crucial for ongoing security. For more details on assessment strategies, refer to our blog post on A Technical Breakdown of Vulnerability Scanning Services.

Remediation steps

The primary remediation for CVE-2026-4201 is to upgrade Apache Struts. Upgrade to version 2.5.31 or 2.6.6 immediately. These versions contain the necessary patches to mitigate the OGNL injection vulnerability.

Apply the patch to all affected applications. Verify the upgrade process by checking the Struts version after deployment. Test applications thoroughly to ensure functionality remains intact post-upgrade.

If immediate patching is not possible, implement temporary workarounds. Restrict access to affected applications from untrusted networks. Deploy a Web Application Firewall (WAF) to filter malicious OGNL expressions in HTTP requests. Configure the WAF to block requests containing suspicious OGNL syntax.

Consider implementing strict input validation at the application layer. While this vulnerability bypasses some existing validation, adding more stringent checks for unusual characters or patterns in user-supplied input can provide an additional layer of defense. However, these workarounds are not a substitute for patching.

Review the principles outlined in How Analyzing CVE-2024 Works and What You Should Patch for a broader understanding of vulnerability management.

Timeline of disclosure

January 10, 2026: Security researcher "StrutsHunter" privately reports the vulnerability to the Apache Struts team. The report includes proof-of-concept details.

January 15, 2026: Apache Struts security team acknowledges the report and begins investigation. The team confirms the critical nature of the flaw.

February 28, 2026: Apache Struts releases patched versions 2.5.31 and 2.6.6. They also publish Security Bulletin S2-070, detailing CVE-2026-4201.

March 1, 2026: Public disclosure of CVE-2026-4201 occurs. Various security advisories and news outlets begin reporting on the critical RCE.

March 5, 2026: Active exploitation attempts of CVE-2026-4201 are observed in the wild. Threat actors begin scanning for and targeting unpatched Struts applications.

The rapid transition from disclosure to active exploitation underscores the urgency of patching this critical Apache Struts RCE.