Apache Struts CVE-2026-73632

The SMD/JSON-RPC handling mode of the Apache Struts JSON interceptor must be explicitly enabled in the application's struts.xml or equivalent configuration - this mode is not active by default. Applications using only the json result type are categorically not affected and require no remediation. Exploitation further requires that the attacker holds a valid low-privilege authenticated session (CVSS PR:L), ruling out unauthenticated attackers. Concurrent request load is necessary to trigger the state-sharing condition, meaning the attack is less reliable against lightly loaded applications where request overlap is infrequent. The impact is limited to confidentiality of response content - no integrity modification or availability disruption is possible through this vector.

The overall risk profile is moderate-to-low despite the network-accessible attack vector. CVSS 3.1 scores this at 4.3 (Medium) with AV:N/AC:L/PR:L/UI:N/S:U/C:L - confirming a low-privilege authenticated vector with limited confidentiality impact and no integrity or availability consequence. The EPSS score of 0.15% at the 4th percentile indicates this vulnerability is statistically unlikely to see opportunistic exploitation in the near term. No KEV listing exists, and no public exploit code has been identified, further reducing urgency. The single most important risk-limiting factor is that the vulnerable code path - SMD/JSON-RPC handling in the JSON interceptor - is not enabled by default, meaning the vast majority of Struts deployments are not exposed. The gap between the CVSS score and EPSS is consistent with a non-default configuration dependency that sharply narrows the exploitable population. Even a mid-sized municipal IT team in leszno running a Struts-based internal application should first verify whether the SMD/JSON-RPC interceptor is actually active before treating this as an emergency - for most deployments, it will not be. Priority should be assigned to environments that have explicitly enabled SMD/JSON-RPC functionality, particularly those handling sensitive per-user data in concurrent-request scenarios.

An authenticated low-privilege user sends a high volume of concurrent JSON-RPC requests to a Struts 7.2.1 application with the SMD/JSON-RPC interceptor enabled, exploiting the unsynchronized serialization state to observe fragments of response content generated for another user's simultaneous request - potentially including sensitive field values serialized as part of that user's JSON response. No public exploit code has been identified at time of analysis, so successful exploitation currently depends on manual implementation of the concurrent-request timing technique.