CRITICAL

CVE-2026-104711

Apache Struts: OGNL injection in the legacy RESTful action mapper

CVSS v3

9.8

CRITICAL

EPSS Score

—

exploit probability

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are n

Technical details

CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2026-10-05
Last Modified: 2026-10-06

Frequently asked questions

What is CVE-2026-104711?

Is CVE-2026-104711 actively exploited?

Active exploitation of CVE-2026-104711 has not been confirmed.

What is the CVSS score for CVE-2026-104711?

CVE-2026-104711 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Is CVE-2026-104711 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 50 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database