Apache Struts vulnerabilities
99 published vulnerabilities in Apache Struts, 9 of them exploited in the wild. The most were published in 2016 (19), and 9 so far in 2026.
Apache Struts vulnerabilities by year
2005
2006
2007
2008
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2023
2024
2025
2026
Most exploited Apache Struts vulnerabilities
- CVE-2020-17530 Apache Struts Remote Code Execution
- CVE-2017-9791 Apache Struts 1 Improper Input Validation
- CVE-2017-5638 Apache Struts Remote Code Execution
- CVE-2013-2251 Apache Struts Improper Input Validation
- CVE-2012-0391 Apache Struts 2 Improper Input Validation
- CVE-2018-11776 Apache Struts Remote Code Execution
- CVE-2017-9805 Apache Struts Deserialization of Untrusted Data
- CVE-2016-3081 Apache Struts Command Injection
- CVE-2006-1547 Apache Struts 1 ActionForm Denial-of-Service
- CVE-2013-4316 Code injection in Apache Struts
- CVE-2012-0838 Apache Struts Code injection due to conversion error
- CVE-2026-104711 Apache Struts: OGNL injection in the legacy RESTful action mapper
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.