CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin
Concurrent requests may share serialization state, exposing response data from one session to another in Apache Struts JSON-RPC configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73632?
CVE-2026-73632 is a medium-severity vulnerability in Apache Struts, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.
This issue affects Apache Struts: 7.2.1.
Users are recommended to upgrade to version 7.3.0, which fixes the issue.
Weakness: CWE-567
Which versions are affected by CVE-2026-73632?
It affects 1 product.
Products include Apache Struts.
How do I fix CVE-2026-73632?
No fix has been published for CVE-2026-73632 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73632 being exploited?
There is no known exploitation of CVE-2026-73632 in the wild and no public exploit code.
Other vulnerabilities in Apache Struts
Sources
Also known as GHSA-87hf-473v-8h9c.