CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability
Vulnerability summary
CVE-2018-11776 is a high (CVSS 9.3) vulnerability in Apache Struts. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 6 public exploits are recorded.
Timeline
- 22-08-2018PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVApache Struts Remote Code Execution Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
CVSS metrics
4 scores · 3 sources · 3 versions- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
99.99%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.99% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2018-11776
Public exploits
6 foundCve 2018 11776 Python Poc
Maturity: poc
Exploit Reference (lgtm.com)
Maturity: unknown
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)
Maturity: poc
Show all 6 exploits
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)
Maturity: weaponized
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)
Maturity: poc
Apache Struts 2 Namespace Redirect OGNL Injection
exploit/multi/http/struts2_namespace_ognl
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Netapp4 products
- active_iq_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.5 (No fix recorded)
- oncommand_insightna
- oncommand_workflow_automationna
- snapcenterna
Oracle3 products
- communications_policy_management< 12.5.0
- enterprise_manager_base_platform13.3.0.0 | 13.4.0.0
- mysql_enterprise_monitor≤ 3.4.9.4237 | ≥ 4.0.0, ≤ 4.0.6.5281 | ≥ 8.0.0, ≤ 8.0.2.8191
Apache1 product
- struts≥ 2.0.4, < 2.3.35 | ≥ 2.5.0, < 2.5.17
Apache software foundation1 product
- apache struts2.3 to 2.3.34 | 2.5 to 2.5.16
Org.apache.struts1 product
- struts2-core≥ 2.0.4, < 2.3.35 | ≥ 2.5, < 2.5.17
5 vendors · 10 products
References
32 linksShow all 32 references
- security.netapp.com/advisory/ntap-20181018-0002/Third Party Advisory
- www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.htmlPatchThird Party AdvisoryWEB
- security.netapp.com/advisory/ntap-20180822-0001/Third Party Advisory
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txtBroken LinkMailing ListThird Party AdvisoryWEB
- packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.htmlThird Party AdvisoryVDB EntryWEB
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776Government ResourceUS Government ResourceWEB
- github.com/apache/strutsPACKAGE