9.8
Critical
CVE-2020-17530 Apache Struts Remote Code Execution Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-917
Description
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Struts | Versions not published |
Other CVEs of Apache Struts
The 33 CVEs of Apache Struts →
CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
Not rated
CVE-2026-104713
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Not rated
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
Not rated
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
Not rated