Apache Struts EUVD-2026-59605

Exploitation requires that the target Apache Struts 7.2.1 application has explicitly enabled the JSON plugin AND configured it to populate action objects from JSON request bodies - this is not the default Struts configuration. The CVSS vector (PR:L) confirms that at minimum low-privilege authentication is required; unauthenticated exploitation is not supported by available data. Successful data leakage further depends on concurrent request timing: another user's request must be in-flight and in a parsing phase simultaneously, meaning the application must be under moderate-to-high concurrency for the race condition to be practically triggerable. Exploitation is strictly version-specific to Struts 7.2.1. Applications using the JSON plugin only for non-sensitive data flows face negligible practical impact even if technically vulnerable.

The vendor-assigned CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable, low-privilege-required flaw with limited confidentiality impact and no integrity or availability consequence. EPSS at 0.15% (4th percentile) strongly corroborates low active exploitation interest. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been reported, aligning with a 'no public exploit identified at time of analysis' posture. The non-default nature of the JSON plugin is a meaningful real-world limiter: only applications that have deliberately enabled JSON-based action population are in scope, materially reducing the exposed population. The AC:L CVSS metric may slightly overstate attacker ease given the concurrent timing dependency - practical exploitation likely requires the target application to be under sufficient concurrent load to trigger state collision. Overall, this is a genuine but low-priority finding: unless the application handles sensitive per-user data via JSON endpoints and is known to have the plugin enabled, it does not warrant emergency response.

An authenticated attacker with low-privilege access sends a high volume of concurrent JSON requests to a Struts 7.2.1 application with the JSON plugin enabled, timing them to collide during the shared parsing phase. Due to unsynchronized parsing state, the attacker's response may contain data fragments from a concurrent legitimate user's request, exposing sensitive fields such as form input or session-bound parameters. No public exploit code is known at time of analysis, and reliable triggering requires sustained concurrent load on the target endpoint.