https://seclists.org/oss-sec/2026/q4/49: CVE-2026-104711: Apache Struts: OGNL injection in the legacy STful action mapper
Affected Software
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments are those using the legacy RESTful action mapper on Apache Struts versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, or 7.0.0 through 7.3.0. Struts 7 is affected only if its OGNL allowlist has been disabled.
Are applications using the default Struts configuration affected?
No. Applications using the default action mapper are not affected, and neither are applications using the restful2 mapper or the Struts REST plugin.
What does an attacker need to exploit this vulnerability?
An attacker needs to send a crafted request to an application configured with the legacy RESTful action mapper. The crafted request can inject an OGNL expression and may lead to remote code execution.
What can be done if an immediate upgrade is not possible?
Move away from the legacy RESTful action mapper, such as by using the default action mapper or the restful2 mapper, which are not affected. For Struts 7, ensure the OGNL allowlist remains enabled.
Which versions address the issue?
Upgrade to Apache Struts 6.12.0 or 7.4.0, which fix the issue.