On October 8, 2026, CISA added CVE-2016-3081 to the Known Exploited Vulnerabilities catalog. The federal remediation due date is October 11, 2026 — today for U.S. civilian agencies under Binding Operational Directive rules. The issue is Apache Struts 2.3.x with Dynamic Method Invocation (DMI) enabled: a crafted method: expression can lead to remote code execution. Affected release lines called out in public advisories include 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28. Fixed builds on those trains include 2.3.20.3, 2.3.24.3, and 2.3.28.1. If your SaaS still runs a Java monolith, a customer-installed on-prem connector, or a forgotten Struts admin UI behind VPN, treat this as a same-day inventory and patch sprint. KEV listing means exploitation is confirmed, not theoretical — and October's Flax Typhoon-adjacent KEV wave also pulled in other aged infrastructure CVEs.
What Dynamic Method Invocation actually does
DMI lets Struts route to action methods based on request parameters rather than a fixed mapping. That convenience is the attack surface: when DMI is on, attackers can influence which method runs. CVE-2016-3081 is the S2-032 class problem — malicious method expressions evaluating into code execution on vulnerable 2.3.x builds. Modern Struts guidance has long recommended keeping DMI off unless you have a deliberate reason and a hardened configuration. Do not assume "we are on Struts 6" without evidence. Inventory every WAR, Spring Boot fat JAR that still embeds struts2-core, and vendor appliance that ships a Struts console. Parse pom.xml / lockfiles and container digests, not tribal memory.
Remediation order that fits a SaaS weekend
1. Inventory. Search images and repos for struts2-core versions in the vulnerable ranges. Include staging, demo, and partner sandboxes. 2. Patch floor. Move each affected train to at least 2.3.20.3, 2.3.24.3, or 2.3.28.1 — or jump to a currently supported Struts major if your regression budget allows. Prefer vendor-supported lines over "pin forever on 2.3.28.1." 3. Disable DMI where product code does not require it. Apache's S2-032 advisory treats turning DMI off as the interim mitigation when you cannot upgrade immediately; validate flows that used dynamic method names. 4. Hunt. Review access logs for unusual method: parameters, OGNL-looking payloads, and spikes against login or filter endpoints. Preserve logs before blue-green wipes them. 5. Evidence pack. Record prior versions, upgrade timestamps, who approved, and whether IoCs appeared. Buyers will ask.
Struts KEV checklist (CVE-2016-3081 / due 2026-10-11)
[ ] List every deployable with struts2-core in vulnerable 2.3.x ranges
[ ] Confirm DMI enabled/disabled per app (config + runtime)
[ ] Upgrade to fixed builds OR disable DMI + test critical actions
[ ] WAF/log hunt for method: / OGNL probes last 30 days
[ ] Rotate secrets if compromise suspected; snapshot before rebuild
[ ] Customer note ready for on-prem connectors still on old WARsWhy founders should care beyond "old Java"
Agencies and mid-market buyers increasingly map vendor questionnaires to CISA KEV response times. A Struts RCE in a docs preview, claim-status portal, or internal admin that still powers a customer workflow is a contract risk, not only an engineering footnote. If you acquired a Java product line, assume Struts debt exists until proven otherwise. Also separate "internet-facing" from "safe." VPN-only consoles get compromised through stolen VPN sessions and chaining. KEV actors automate; they do not skip hosts because your network diagram looked tidy in 2019.
Founder takeaway
CVE-2016-3081 is an aged Struts DMI RCE now on CISA KEV with a October 11, 2026 federal due date. Inventory Struts 2.3.x, upgrade to the fixed builds on your train (or a supported major), disable Dynamic Method Invocation when you cannot patch immediately, and preserve evidence of hunting. Java SaaS that treats office-hour "legacy" stacks as out of scope will learn the hard way that KEV deadlines do not care about your rewrite roadmap.
How Struts shows up in "modern" SaaS estates
Struts rarely appears on the homepage tech stack slide. It appears in acquired claims portals, university research upload tools your product still mirrors, vendor appliances that expose a Java admin console, and internal ops UIs that never got the React rewrite. Each of those surfaces can sit behind SSO and still be reachable once a session or VPN credential is stolen. KEV scanning does not require the host to be famous — only reachable and unpatched. If you run Kubernetes, do not stop at cluster CVEs. Image scanning must flag struts2-core JARs inside fat images. If you outsource a "legacy Java" module to a contractor, put the version pin in the contract: unsupported Struts 2.3.x with DMI on is now a named KEV liability.
Action mapping reviews matter after you disable DMI. Teams that leaned on method: shortcuts for CRUD actions will see 404s or unexpected default methods. Budget a half-day per app to rewrite mappings to explicit method bindings, then re-run smoke tests on login, file upload, and admin save paths — the flows attackers probe first.
Detection ideas that do not require a new SIEM product
Export the last 30 days of reverse-proxy logs for Struts apps and grep for method: , OGNL-looking characters, and repeated 500s on action endpoints. Feed those into whatever alerting you already have. If you use WAF rulesets with Struts signatures, confirm they are enabled in blocking mode on internet-facing vhosts — detect-only helped last year's questionnaire, not this week's KEV. When you upgrade, pin the new artifact digest in your deploy system and fail CI if an older digest reappears. Drift is how "we patched staging" becomes "production rolled back to the vulnerable tag."
Finally, brief customer success if you ship on-prem Java connectors. Give them a one-page advisory with CVE id, fixed versions, and a verification command. Silence looks like negligence when CISA's due date is already public.
