{"id":"CVE-2026-104711","published":"2026-10-05T19:17:14Z","modified":"2026-10-08T19:05:18Z","title":"Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…","vendor":"Apache Software Foundation","product":"Apache Struts","tier":"core","eol":null,"description":{"text":"Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.","provenance":"source","from":"NVD"},"summary":{"text":"Apache Struts contains an expression language injection flaw in its legacy RESTful action mapper, which lets a crafted request inject an OGNL expression into the application. An attacker needs only network access to send the request, with no authentication or user interaction, and the flaw applies only when the application uses the legacy RESTful mapper and, on Struts 7, has the OGNL allowlist disabled.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:38Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01394,"percentile":0.7231,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 14, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ace466c18a71dd7afa3f788","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6accf723f346ce4b8a50d55a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6acba8a68a86c4d9508005a7","created":"2026-10-11"},{"name":"Known_Cve | Oct 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6aca554665c47eb24716f8f2","created":"2026-10-10"},{"name":"Known_Cve | Oct 10, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac903591ff588ac9423f235","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac7b19da11e545ded10ae9b","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac65e5b607642608f852c9a","created":"2026-10-07"},{"name":"Known_Cve | Oct 7, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac50f851d74c73e484f44c6","created":"2026-10-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-917","name":"Improper Neutralization of Special Elements used in an Expression Language Statement"}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-075","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/10","tags":["Mailing List","Third Party Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-92622","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92622","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104711","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":23.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.46,"detail":"percentile 0.7231"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apache-struts-cwe-917"}}