Loading story…
A critical XML External Entity (XXE) injection vulnerability, tracked as CVE-2025-68493, has been identified in the XWork component of Apache Struts 2. This flaw allows attackers to exploit improper XML input validation, potentially leading to sensitive data disclosure, server-side request forgery (SSRF), and denial-of-service (DoS) attacks. The vulnerability affects a wide range of Struts 2 versions, including 2.0.0–2.3.37, 2.5.0–2.5.33, and 6.0.0–6.1.0, exposing millions of applications to risk. Security researchers at ZAST.AI reported the issue, and Apache has rated the vulnerability as 'Important' due to its significant impact on data confidentiality and system availability.
Organizations using affected versions are strongly advised to upgrade to Struts 6.1.1, which addresses the vulnerability. The issue is remotely exploitable and has been assigned a CVSS 3.1 score of 8.1 (High). Immediate patching is recommended to prevent exploitation, as attackers can leverage this flaw to extract configuration files, database credentials, and other sensitive information from vulnerable servers. The vulnerability has been confirmed by both independent security researchers and the Apache security team.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Sonatype researchers reported that more than 387,000 downloads of vulnerable Apache Struts versions occurred in a single week, with 98% involving end-of-life releases. The finding highlighted slow adoption of the fixed Struts 6.1.1 release and ongoing supply-chain exposure tied to CVE-2025-68493.
Follow-up discussion on oss-sec argued that CVE-2025-68493 and similar recent Apache XXE issues share a root cause in insecure XML parsing defaults in Java's standard library. Participants called for broader audits of XML parsing across Apache projects.
The CVE-2025-68493 record was modified to add CVSS v3.1 scoring details and additional references. The update reflected a high-severity rating and expanded metadata around the disclosure.
The CVE entry for CVE-2025-68493 was published with high-severity classification and references to the Apache advisory and oss-security disclosure. It described the flaw as remotely exploitable with low attack complexity and user interaction required.
Apache disclosed CVE-2025-68493, an XXE issue caused by missing XML validation in the outdated XWork component, affecting Struts/XWork versions up to 6.1.0. Apache recommended upgrading to Struts 6.1.1 and published advisory S2-069, with mitigations for users unable to upgrade immediately.
Researchers at ZAST.AI identified an XML External Entity vulnerability in Apache Struts' XWork XML parsing and reported it to the Apache Struts team. The flaw was later tracked as CVE-2025-68493.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourceseclists.org
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, tracked as CVE-2025-66675, has been identified in Apache Struts 2, affecting versions 2.0.0 through 6.7.4 and 7.0.0 through 7.0.3. The flaw arises from a file leak in the multipart request processing component, which can lead to disk exhaustion and result in a denial-of-service (DoS) condition. Attackers can exploit this vulnerability remotely, potentially causing affected servers to crash by exhausting disk resources. The issue has been addressed in versions 6.8.0 and 7.1.1, and users are strongly advised to upgrade to these fixed versions to mitigate the risk. The vulnerability is related to improper handling of file uploads in multipart requests, which can allow attackers to trigger uncontrolled file creation or retention, leading to resource exhaustion. Security advisories recommend prompt patching, as the flaw is remotely exploitable and could be leveraged in automated attacks targeting exposed Struts 2 instances. No evidence of exploitation in the wild has been reported as of the latest updates, but the critical nature of the flaw warrants immediate attention from organizations using vulnerable versions.
Jun 29, 2026
Apache Struts developers released fixes for **CVE-2024-53677**, a critical vulnerability in the framework's file upload handling that can allow malicious file upload and **remote code execution** in applications using `FileUploadInterceptor`. The flaw affects Struts versions `2.0.0` through `2.3.37`, `2.5.0` through `2.5.33`, and `6.0.0` through `6.3.0.2`, and has been assigned a **CVSS 4.0 score of 9.5**. Public proof-of-concept exploit code is available, and CSIRT.SK reported that the vulnerability is being actively exploited in the wild. Apache's guidance points organizations to **Struts 6.4.0 or later**, but the vendor's file upload documentation indicates remediation is not limited to patching alone: affected applications must also update source code to adopt the framework's newer file upload mechanism. Defenders are advised to review network and security logs for signs of compromise, as exposed internet-facing Struts applications that still rely on the legacy upload interceptor face elevated risk of exploitation.
Jul 24, 2026
Apache Struts 2 contained a remote code execution flaw, **`CVE-2017-5638`**, in the Jakarta Multipart parser that allowed attackers to run arbitrary commands by sending crafted HTTP file-upload headers, including malicious `Content-Type`, `Content-Disposition`, or `Content-Length` values. The vulnerability affected Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1, and the CVE record notes that exploitation was observed in the wild, including attacks using a `Content-Type` header containing a `#cmd=` string. The Apache Software Foundation highlighted **`CVE-2017-5638`** as one of the notable exploitation-related cases in its annual security reporting, which summarized hundreds of vulnerability reports handled across more than 340 Apache projects. ASF said its 2020 security operations processed 18,000 security-related emails down to 946 non-spam threads, tracked 376 new vulnerability reports across 101 top-level projects, and assigned 151 CVE identifiers from 341 closed reports, underscoring both the scale of Apache’s disclosure workload and the continued significance of high-impact flaws such as the Struts RCE.
Aug 15, 2026