CVE-2017-9791

Apache Struts 1 suffered an improper input validation flaw allowing remote code execution via malicious field values in raw messages.

This vulnerability allowed attackers to execute arbitrary code on systems running the vulnerable Struts 1 plugin, leading to potential data breaches and system compromise. DIB organizations must ensure all legacy frameworks are patched or replaced, as unpatched CVEs like this are actively exploited in the wild and represent a severe compliance risk under NIST 800-171. Immediate action includes scanning for the vulnerable plugin and applying patches or migrating to supported alternatives.

Shame score — The vulnerability was actively exploited in the wild (KEV) and allowed remote code execution, representing a severe, avoidable failure due to reliance on an outdated, unpatched framework.