# CVE-2026-104711: Apache Struts expression language injection in legacy RESTful action mapper

Source: https://junglewise.ai/threats/cve-2026-104711-improper-neutralization-of-special-elements-used-in-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104711 · Severity: info · Published 2026-10-05

Apache Struts is a web framework used to build Java web applications. When configured to use the legacy RESTful action mapper, an attacker can craft a malicious request containing code that executes on the server, leading to complete system compromise. Applications using the default action mapper, restful2 mapper, or Struts REST plugin are not affected.

Technologies: [Apache Struts](https://junglewise.ai/threats/technologies/struts). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-104711 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104711 being exploited in the wild.

**How severe is CVE-2026-104711?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.

**Is there a fix for CVE-2026-104711?** Yes: fixed in Struts 6.12.0, Struts 7.4.0. Until then: Use the default action mapper, the restful2 mapper, or the Struts REST plugin instead of the legacy RESTful action mapper. For Struts 7, ensure the OGNL allowlist is enabled (the default configuration).</anigation>
<parameter name="timeline">[
  {
    "kind": "advisory",
    "at": "2026-10-05"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104711 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104711?** Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Struts 6.12.0, Struts 7.4.0

Use the default action mapper, the restful2 mapper, or the Struts REST plugin instead of the legacy RESTful action mapper. For Struts 7, ensure the OGNL allowlist is enabled (the default configuration).</anigation>
<parameter name="timeline">[
  {
    "kind": "advisory",
    "at": "2026-10-05"
  }
]

## Technical details

OGNL expression language injection in the legacy RESTful action mapper allows unauthenticated remote code execution via crafted requests. Struts versions 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.11.0, and 7.0.0–7.3.0 are affected when the legacy mapper is used; Struts 7 is additionally protected by default OGNL allowlist enforcement. The vulnerability requires network access and no authentication.

## Affected products

- Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://cwiki.apache.org/confluence/display/WW/S2-075](https://cwiki.apache.org/confluence/display/WW/S2-075)

## Related threats

- [Apache Struts race condition in message formatter for date/time arguments](https://junglewise.ai/threats/cve-2026-104714-concurrent-execution-using-shared-resource-with-improper)
- [Apache Struts REST plugin unbounded request body denial of service](https://junglewise.ai/threats/cve-2026-104713-allocation-of-resources-without-limits-or-throttling)
- [Apache Struts asymmetric resource consumption in BigDecimal rendering](https://junglewise.ai/threats/cve-2026-104712-asymmetric-resource-consumption-amplification-vulnerability-in)
- [Apache Struts has a Denial of Service vulnerability](https://junglewise.ai/threats/cve-2025-66675-apache-struts-has-a-denial-of-service-vulnerability)
- [Apache Struts is Vulnerable to DoS via File Leak](https://junglewise.ai/threats/cve-2025-64775-apache-struts-is-vulnerable-to-dos-via-file-leak)