If your Java app still uses Struts’ old REST mapper, upgrade before someone tests it

Apache Struts just closed another OGNL injection path. If your Java app is still wired to the legacy RESTful action mapper, a crafted request can push an expression that may end in remote code execution. The default mapper, the restful2 mapper and the maintained REST plugin are fine. The legacy one is not, and it has been deprecated for a reason.

Legacy REST mapper still on? That is the configuration that turns this into remote code execution.

What happened

On October 5, 2026, Apache published S2-075 / CVE-2026-104711. Improper neutralization of expression-language input in the legacy RESTful action mapper lets a crafted request inject an OGNL expression. Apache rates the issue Moderate. Fixed releases are Struts 6.12.0 and Struts 7.4.0. Struts 7 is affected only when the OGNL allowlist is disabled; that allowlist is on by default.

Affected lines: 2.0.0 through 2.3.37 (EOL), 2.5.0 through 2.5.33 (EOL), 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 with the allowlist off. Credit goes to LeaveSong. No public exploitation has been reported with the advisory.

Why it matters

Struts OGNL bugs have a long history of becoming everyone’s problem once a scanner finds them. The good news is the precondition is narrow: only apps that still use the legacy RESTful action mapper are in scope. The bad news is that mapper often lives in apps nobody has touched since 2018, which is exactly where inventory fails.

What to do first

• Search application configs and struts.xml for the legacy RESTful action mapper (not restful2, not the Struts REST plugin).
• Upgrade to Struts 6.12.0 or 7.4.0. On Struts 7, confirm the OGNL allowlist is still enabled.
• If you cannot upgrade today, switch the app to the default action mapper, the restful2 mapper, or the maintained REST plugin — Apache’s documented workaround.
• Flag any internet-facing Struts 2.3 / 2.5 EOL app for an emergency path: those lines will not get a future fix beyond what is already shipped.

Details

• CVE / advisory: CVE-2026-104711, Apache Struts S2-075. Severity: Moderate. Impact: possible remote code execution via OGNL injection.
• Condition: Application configured with the legacy RESTful action mapper. Default mapper, restful2 mapper and Struts REST plugin: not affected. Struts 7: only when OGNL allowlist is disabled.
• Fixed: Struts 6.12.0 or 7.4.0.
• Affected: 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.11.0, 7.0.0–7.3.0 (allowlist off).
• Published: October 5, 2026 (oss-security). Reporter: LeaveSong.
• Exploitation: Not reported with the advisory.

Hunt / verify

• Grep deployable configs for the legacy RESTful action mapper class / constant. Document which apps still set it.
• Confirm Struts jar versions on each host (struts2-core-*.jar) against 6.12.0 / 7.4.0.
• On Struts 7, verify the OGNL allowlist setting has not been turned off in custom security configs.
• Watch for unusual OGNL-looking payloads in access logs against Struts endpoints after the advisory date.

Struts S2-075 (CVE-2026-104711): OGNL injection → possible RCE if the legacy RESTful action mapper is still configured. Upgrade to 6.12.0 or 7.4.0, or switch off that mapper. Default / restful2 / REST plugin apps are fine. Published Oct 5.

Sources

• https://cwiki.apache.org/confluence/display/WW/S2-075
• https://www.openwall.com/lists/oss-security/2026/10/05/10
• https://www.cve.org/CVERecord?id=CVE-2026-104711
• https://struts.apache.org/announce-2026
• https://www.rapid7.com/db/vulnerabilities/cve-2026-104711/

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].