CVE-2016-3081

Apache Struts suffered a command injection flaw allowing remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation was enabled.

This command injection vulnerability in Apache Struts allowed remote attackers to execute arbitrary code, directly enabling remote code execution (RCE). Defense-industrial-base organizations must care because unpatched Struts instances remain actively exploited in the wild, leading to system compromise, data theft, and ransomware entry. Organizations should immediately patch Struts and monitor for exploitation attempts.

Shame score — A known, actively exploited command injection flaw in a widely deployed framework that remains unpatched in many environments, demonstrating severe negligence and avoidable risk.