Dynamic Method Invocation method: prefix expression injection in Apache Struts 2.3 enables remote code execution (CVE-2016-3081)
CISA added this ten-year-old flaw to KEV on 2026-10-08 with a 2026-10-11 remediation deadline, alongside advisory AA26-281A on Chinese government-linked actors, and public exploit code (Exploit-DB 39756, Metasploit struts_dmi_exec) means any remaining Struts 2.3 app with Dynamic Method Invocation enabled is trivially compromisable.
When Dynamic Method Invocation is enabled, a request using the method: prefix can carry a malicious expression that Struts evaluates on the server, letting an unauthenticated attacker execute arbitrary code on the application host. Affects Struts 2.3.20 through 2.3.28 (except 2.3.20.3 and 2.3.24.3).
Affected: Apache Struts 2.3.20 through 2.3.28, except 2.3.20.3 and 2.3.24.3
How to Test
Inventory Java web applications for the struts2-core library and confirm its version is outside the 2.3.20–2.3.28 range (or is 2.3.20.3 / 2.3.24.3 / 2.3.28.1); check your Struts configuration for whether Dynamic Method Invocation is enabled. Review web server and application access logs for action requests containing a method: prefix with unexpected expression content, and treat any such hits on an unpatched instance as a potential compromise requiring host forensics.
How to Patch
Upgrade to Apache Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 (Apache states no backward-compatibility issues are expected). If the upgrade must wait, disable Dynamic Method Invocation, or implement your own ActionMapper based on the source of the recommended Struts versions as the S2-032 advisory describes.