Apache Struts CVE-2026-104711

Exploitation requires the target application to be configured to use the legacy RESTful action mapper; this is the exact enabling condition. On the Struts 7 branch there is an additional prerequisite: the OGNL allowlist must have been explicitly disabled, as it is enabled by default and blocks the injection. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are NOT affected regardless of version. The decisive limiting factor is therefore this non-default mapper configuration, which is not present in standard deployments; where it is absent, the vulnerability is not reachable despite the AV:N/PR:N base vector. No user interaction or authentication is required once the vulnerable configuration exists.

The raw signals appear alarming - CVSS 3.1 base of 9.8 with AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H impact, consistent with unauthenticated remote code execution via OGNL/Expression Language injection (CWE-917) in a widely-deployed Java framework. However, these signals conflict sharply with the exploitation reality described by the vendor, and the aggregate picture is of a conditional, not blanket, critical. The flaw is reachable ONLY when the application is configured to use the legacy RESTful action mapper, and on the Struts 7 branch only when the OGNL allowlist (enabled by default) has been explicitly disabled; the default action mapper, the restful2 mapper, and the Struts REST plugin are all unaffected. This means the PR:N/AC:L base vector overstates real-world attackability, because a non-default, attacker-uncontrollable deployment condition must be present - a factor the CVSS 3.1 base score cannot express. The supporting threat intelligence corroborates a lower practical priority: EPSS is only 0.36% (28th percentile), there is no CISA KEV listing, and no public exploit code is referenced. Exploitation status is therefore 'no public exploit identified at time of analysis'. Bottom line: this is a genuine critical for the subset of organizations running the legacy RESTful mapper (where it warrants urgent patching), but for the majority on default configurations the effective risk is low. Treat the 9.8 as a worst-case ceiling gated behind a specific configuration, not as a ubiquitous network threat.

An attacker enumerates internet-facing Apache Struts applications and identifies one configured with the legacy RESTful action mapper (or a Struts 7 instance with the OGNL allowlist disabled). They send a single crafted HTTP request embedding a malicious OGNL expression in the request path/action, which the mapper evaluates, achieving remote code execution as the web application's user. No public exploit code is referenced at time of analysis, and success is contingent on the non-default mapper configuration being present.