Is CVE-2026-104711 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104711 being exploited in the wild.

How severe is CVE-2026-104711?

Informational severity, published 5 October 2026.

Which products and versions are affected?

Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.

How is CVE-2026-104711 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104711?

Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104711: Apache Struts expression language injection in legacy RESTful action mapper

CVE-2026-104711 · Severity: info · Published 2026-10-05

Apache Struts is a web framework used to build Java web applications. When configured to use the legacy RESTful action mapper, an attacker can craft a malicious request containing code that executes on the server, leading to complete system compromise. Applications using the default action mapper, restful2 mapper, or Struts REST plugin are not affected.

Technologies: Apache Struts. Vendors: Apache.

Quick answers

Is CVE-2026-104711 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104711 being exploited in the wild.
How severe is CVE-2026-104711?: Informational severity, published 5 October 2026.
Which products and versions are affected?: Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.
Is there a fix for CVE-2026-104711?: Yes: fixed in Struts 6.12.0, Struts 7.4.0. Until then: Use the default action mapper, the restful2 mapper, or the Struts REST plugin instead of the legacy RESTful action mapper. For Struts 7, ensure the OGNL allowlist is enabled (the default configuration).</anigation> <parameter name="timeline">[ { "kind": "advisory", "at": "2026-10-05" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104711 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104711?: Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Struts 6.12.0, Struts 7.4.0

Use the default action mapper, the restful2 mapper, or the Struts REST plugin instead of the legacy RESTful action mapper. For Struts 7, ensure the OGNL allowlist is enabled (the default configuration).</anigation> <parameter name="timeline">[ { "kind": "advisory", "at": "2026-10-05" } ]

Technical details

OGNL expression language injection in the legacy RESTful action mapper allows unauthenticated remote code execution via crafted requests. Struts versions 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.11.0, and 7.0.0–7.3.0 are affected when the legacy mapper is used; Struts 7 is additionally protected by default OGNL allowlist enforcement. The vulnerability requires network access and no authentication.

Affected products

Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.