Is CVE-2026-104714 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104714 being exploited in the wild.

How severe is CVE-2026-104714?

Informational severity, published 5 October 2026.

Which products and versions are affected?

Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.

How is CVE-2026-104714 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104714?

Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104714: Apache Struts race condition in message formatter for date/time arguments

CVE-2026-104714 · Severity: info · Published 2026-10-05

Apache Struts is a popular web framework for building Java applications. A race condition in the message formatting component allows one user's date or time values to appear in another user's response when concurrent requests format localized messages, potentially exposing sensitive data or causing the application to display server errors. This affects applications that use date or time formatting in their localized messages.

Technologies: Apache Struts. Vendors: Apache.

Quick answers

Is CVE-2026-104714 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104714 being exploited in the wild.
How severe is CVE-2026-104714?: Informational severity, published 5 October 2026.
Which products and versions are affected?: Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.
Is there a fix for CVE-2026-104714?: Yes: fixed in Struts 6.12.0, 7.4.0. Until then: For messages that format date or time arguments, format the value before passing it to the message and use a message that interpolates the already-formatted value without applying a date or time format to it, which eliminates the exposure for that message. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104714 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104714?: Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Struts 6.12.0, 7.4.0

For messages that format date or time arguments, format the value before passing it to the message and use a message that interpolates the already-formatted value without applying a date or time format to it, which eliminates the exposure for that message.

Technical details

A race condition exists in the application-wide text provider that retains formatters used to render localized messages. When a message formats a date or time argument, concurrent requests reuse the same retained formatter without isolation, allowing one request's formatted value to leak into another request's response or causing rendering failures. This requires only ordinary concurrent traffic and no special attack; applications using localized messages that do not format date or time arguments are not affected.

Affected products

Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0

Timeline

2026-10-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.