Our automated tracking framework flagged that CISA added CVE-2016-3081 (Apache Struts) to the Known Exploited Vulnerabilities (KEV) catalog on October 9, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2016-3081 by October 11, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2016-3081 |
| Vendor / product | Apache Struts |
| Vulnerability | Apache Struts Command Injection Vulnerability |
| CVSS base score | 8.1 |
| Added to KEV | October 8, 2026 |
| Days public before listing (NVD → KEV lag) | 3817 |
| Federal patch deadline | October 11, 2026 |
| Known ransomware use | No |
How This Compares to Apache’s Track Record
This one was public for 3817 days before CISA confirmed exploitation — longer than Apache’s 503-day median, a vulnerability that sat exploitable in the open. Apache currently ranks #21 on our KEV Lag leaderboard.
| Apache in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 41 |
| Median lag (public → KEV listing) | 503 days |
| 0-day rate (exploited at or before disclosure) | 2% |
| Entries tied to known ransomware campaigns | 7 |
For perspective, the median across all 1739 tracked KEV entries is 245 days — Apache’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Apache KEV Additions
The most recent Apache vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-34486 | Tomcat | August 4, 2026 | 117 | No |
| CVE-2026-34197 | ActiveMQ | April 16, 2026 | 9 | No |
| CVE-2024-38475 | HTTP Server | May 1, 2025 | 304 | No |
| CVE-2025-24813 | Tomcat | April 1, 2025 | 22 | No |
| CVE-2024-45195 | OFBiz | February 4, 2025 | 153 | No |
What This Means for Defenders
CISA added CVE-2016-3081, an Apache Struts command injection vulnerability (CVSS 8.1), to its Known Exploited Vulnerabilities Catalog. Federal agencies must patch this flaw by October 11, 2026. This vulnerability’s KEV listing means it’s under active exploitation, making immediate patching a high priority for all organizations, not just federal entities. Systems running Apache Struts are directly exposed and should be prioritized for urgent remediation to mitigate significant risk.
The 3817-day lag between public disclosure and KEV listing for CVE-2016-3081 indicates exploitation has likely been ongoing for an extended period. Organizations using Apache Struts should assume compromise is possible and conduct thorough forensic analysis and threat hunting in addition to patching. While there’s no known ransomware use, the command injection nature of this flaw makes it highly attractive for initial access and broader network compromise.
If you can’t patch before the October 11 deadline, implement compensating controls. Isolate affected systems, apply strict network segmentation, and monitor for unusual activity. Deploying Web Application Firewalls (WAFs) with rules to block command injection patterns can also provide a layer of defense until a full patch is deployed.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
