CVE-2018-11776 KEVPublic exploit High · 8.1 EPSS >99.9%

Apache Struts Remote Code Execution Vulnerability

Apache · Struts

Summary

Apache Struts (the Apache web application framework) contains a flaw in its namespace handling that can lead to remote code execution when alwaysSelectFullNamespace is enabled, either by user configuration or through a plugin such as the Convention Plugin, affecting versions 2.3 to 2.3.34 and 2.5 to 2.5.16. An attacker with network access and no privileges could exploit it without user interaction, provided the application uses results without a namespace, or url tags lacking value and action attributes, under a parent package that has no namespace or a wildcard namespace.

Official description · NVD

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Breakdown

82.5 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource dataMedium confidence149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource dataMedium confidence95 general detection rules
What can follow
- Use the system to mine cryptocurrencyT1496 · Resource HijackingSource dataMedium confidence13 general detection rules

First seen exploited 4 months after disclosure. Public exploit code (Metasploit) was available the same day.

DisclosedPublic exploit codeMetasploit22 Aug 2018day 0
First seen exploitedVulnCheck KEV evidence18 Dec 2018+4 mo
Added to CISA KEVEU database agrees3 Nov 2021+3 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

8 related vulnerabilities in the same code over 5 years. The latest fix listed for struts2-core is 2.5.22.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2013-2134Struts 2 before 2.3.14.3 allows remote attackers to execute…16 Jul 2013
same family
CVE-2013-2135Struts 2 before 2.3.14.3 allows remote attackers to execute…16 Jul 2013
Next fix in the same packageHigh
Why these are linked:
- Fixed one release later2.3.14.3 → 2.3.15.1 (org.apache.struts:struts2-core)
- Same code patched: DefaultActionMapper.java (machine-matched)commit 01e6b25 commit 041206d commit 3cfe34f commit 630e1ba
CVE-2013-2248Multiple open redirect vulnerabilities in Apache Struts 2.0.0…18 Jul 2013
same family
CVE-2013-2251Struts Improper Input Validation20 Jul 2013KEV
relatedMedium
Why these are linked:
- Same code patched: DefaultActionMapper.java (machine-matched)Functions: executecommit 3cfe34f commit 630e1ba commit 0c8366c
CVE-2013-4310Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass…30 Sep 2013
relatedHigh
Why these are linked:
- Fixed one release later2.3.15.2 → 2.3.15.3 (org.apache.struts:struts2-core)
- Same code patched: ParameterAction.java (machine-matched)Functions: handleSpecialParameterscommit 0c8366c commit 58947c3 commit c643336
CVE-2013-4316Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation…30 Sep 2013
relatedMedium
Why these are linked:
- Same code patched: RestActionMapper.java (machine-matched)commit 58947c3 commit c643336 commit 6d7ac40 commit 76eb8f3
CVE-2016-4438The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1…4 Jul 2016
relatedMedium
Why these are linked:
- Same code patched: RestActionMapper.java (machine-matched)commit 6d7ac40 commit 76eb8f3 commit 6e87474
This CVECVE-2018-11776Struts Remote Code Execution22 Aug 2018KEV

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.5.11CVE-2017-1261120 Sep 2017
2.5.13CVE-2016-44654 Jul 2016
2.5.13CVE-2016-873820 Sep 2017
2.5.13CVE-2017-980420 Sep 2017
2.5.17CVE-2018-1177622 Aug 2018KEV
2.5.22CVE-2012-15925 Dec 2019
2.5.22CVE-2019-023014 Sep 2020
2.5.22CVE-2019-023314 Sep 2020Latest listed

techniques

3 , grouped by in kill-chain order 3

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

MITRE CTID mapping of the KEV entry · how it is exploited

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

MITRE CTID mapping of the KEV entry · primary impact

ImpactTA0040

Resource Hijacking T1496 Medium

MITRE CTID mapping of the KEV entry · follow-on activity

CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace. Volexity also reports active scanning and attempts to exploit CVE-2018-11776 in order to deploy cryptocurrency miners.

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploitation for Privilege EscalationT1068 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 257 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-11776 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Resource HijackingT149613 general rules

Linux Crypto Mining Pool Connectionshighstable
Monero Crypto Coin Mining Pool Lookuphighstable
Network Communication With Crypto Mining Poolhighstable
Potential Crypto Mining Activityhighstable
Linux Crypto Mining Indicatorshightest
Azure Kubernetes Network Policy Changemediumtest
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest
Azure Kubernetes Secret or Config Object Accessmediumtest

All 13 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-cr6j-3jp9-rw65

Upgrade to 2.5.33

Fixes this CVE and 7 other known vulnerabilities in this package (CVE-2017-12611, CVE-2017-5638, +5).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.5.17 for CVE-2018-11776.

Affected versions, by release line

If you run	Upgrade to
2.5 up to 2.5.17	2.5.33first fix for this CVE: 2.5.17
2.0.4 up to 2.3.35 Still affected on this line by CVE-2019-0230 (fixed in 2.5.22, a newer line); CVE-2019-0233 (fixed in 2.5.22, a newer line); CVE-2020-17530 (fixed in 2.5.26, a newer line); CVE-2021-31805 (fixed in 2.5.30, a newer line); CVE-2023-50164 (fixed in 2.5.33, a newer line); CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).	2.3.35

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Named in 1 threat report

1 reportanomali.com

Reports are matched by finding the exact id CVE-2018-11776 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

anomali.comUndated

WTB: Remote Mac Exploitation Via Custom URL Schemes

The vulnerability, which is known as CVE-2018-11776, comes from an improper validation of namespace input data, and threat actors have already exploited this to install a CNRig cryptocurrency miner on machines.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

20 links, grouped by NVD tag (19 duplicates merged)

Show 7 moreShow fewer

psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012 security.netapp.com/advisory/ntap-20180822-0001/security.netapp.com/advisory/ntap-20181018-0002/exploit-db.com/exploits/45260/exploit-db.com/exploits/45262/exploit-db.com/exploits/45367/oracle.com/security-alerts/cpujul2020.html

Mailing List 1

lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 3 May 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2018-0582

Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)EDB-45260 · remote · linux · 2018-08-26
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)EDB-45262 · remote · multiple · 2018-08-25
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)EDB-45367 · remote · multiple · 2018-09-10 · verified
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)EDB-45367 · remote · multiple · 2018-09-10 · verified

, 30 Oct 2026

>99.9%Top 0.01%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.99%).

3.1

8.1High · 8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2874 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9999 20.0/20

Threat reports1 report 3.9/10

Public exploit code5 NVD references tagged Exploit; 4 Exploit-DB entries; 1 NVD exploit link; 3 advisory exploit references; 15 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 8.1 5.7/7

End-of-life productsupported or unknown 0.0

Total82.5

Record

Published: 22 Aug 2018
Modified: 17 Jun 2026
: CWE-20 Improper Input Validation
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

3What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques