Apache Struts CVE-2026-104714

Exploitation requires the target application to use localized (i18n) messages that format a date or time argument - the vendor explicitly states that applications whose localized messages format no date/time arguments are NOT affected, so this is the exact gating condition. It further requires concurrent request processing so that one request's formatter state bleeds into another's (the shared, non-isolated formatter in the application-wide text provider is the vulnerable component). Limiting factors: the outcome is non-deterministic and timing-dependent (you cannot choose which user's data leaks or when, and it may instead surface as a server error), it only applies to running versions in the listed ranges, and the leaked content is confined to values passed as date/time format arguments rather than arbitrary memory or files.

Signals conflict sharply. The published CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H = 8.8 High) portrays this as a serious network-exploitable flaw, but the underlying defect is a non-deterministic race condition in a shared date/time formatter, and three independent factors pull the real-world risk down. First, EPSS is only 0.18% (7th percentile), indicating very low predicted exploitation likelihood. Second, there is no CISA KEV listing and no public exploit code referenced in any source. Third, the published AC:L is questionable for a 'concurrent execution with improper synchronization' (CWE-362) issue - successful exploitation depends on timing and on another user concurrently rendering a localized date/time message, which is not reliably attacker-controlled; AC:H is more defensible. The C:H/I:H/A:H impact also looks overstated: the described effect is cross-user leakage of a date/time-formatted value (confidentiality) or a transient server error (availability), with no attacker-driven data modification implied, so I:H in particular is hard to justify from the description. Net assessment: this is a legitimate but moderate issue - a real cross-tenant information-disclosure bug worth patching in a normal maintenance cycle, not an emergency. It is NOT a case of active mass exploitation; low EPSS plus absent KEV/POC suggests it is unlikely to be opportunistically weaponized. Discrepancy to verify with vendor: the 8.8 score versus a race-condition info-leak whose practical impact and attack complexity appear lower than the vector states.

An authenticated or anonymous user repeatedly requests a page that renders a localized message containing a date or time argument, while the application concurrently serves other users rendering the same message. Due to the unsynchronized shared formatter in the application-wide text provider, a date/time value belonging to another in-flight request is rendered into the attacker's response, leaking that user's data; alternatively the formatter corrupts and the request fails as a server error. No public proof-of-concept exploit was identified at time of analysis.