Apache Struts. If: remote code execution

Apache Software Foundation Apache Struts

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution.

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 15:17 UTC
Versions per NVD, not the vendor: 7.4.0
6.12.0
Identifiers: CVE-2026-104711
CVSS: 9.8
Source: news
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache Struts. If: remote code execution
Severity: critical. Patch status: fix status unknown.
Affected: Apache Software Foundation Apache Struts
Versions per NVD, not the vendor: 7.4.0, 6.12.0
Ids: CVE-2026-104711

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution.

## Steps
1. Search the repo, its CI and infra config for Apache Software Foundation Apache Struts. If present, report the version in use and whether it's affected.
2. Versions per NVD, not the vendor: Apache Struts: 7.0.x → 7.4.0; 6.0.x → 6.12.0. Don't treat them as a fix until the vendor says so. Apache Struts 2.0.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Apache Struts 7.0.x | per NVD, not the vendor | 7.4.0 | restrict network access to it |
| Apache Struts 6.0.x | per NVD, not the vendor | 6.12.0 | restrict network access to it |
| Apache Struts 2.0.x | not named in the CVE record | check the vendor advisory: https://cwiki.apache.org/confluence/display/WW/S2-075 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-104711") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://cwiki.apache.org/confluence/display/WW/S2-075 https://nvd.nist.gov/vuln/detail/CVE-2026-104711
https://pwned.coffee/i/apache-struts-if-remote-code-execution-cve-2026-104711

Receipt

Exploitation: No known exploitation
By release line, per NVD, not the vendor: Product Affected Version named Source
Apache Struts 7.0.0 to before 7.4.0 7.4.0 NVD per NVD, not the vendor checked 10 Nov
Apache Struts 6.0.0 to before 6.12.0 6.12.0 NVD per NVD, not the vendor checked 10 Nov
Apache Struts 2.0.0 to now fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 10 Nov
The CVE record names no fix for one line; the vendor’s advisory may: cwiki.apache.org
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CISA ADP) for CVE-2026-104711
Last checked: 10 Nov 2026, 15:18 UTC

Product	Affected	Version named	Source
Apache Struts	7.0.0 to before 7.4.0	7.4.0	NVD per NVD, not the vendor checked 10 Nov
Apache Struts	6.0.0 to before 6.12.0	6.12.0	NVD per NVD, not the vendor checked 10 Nov
Apache Struts	2.0.0 to now	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 10 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee