ACTIVELY EXPLOITED
CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability
| Vendor | Apache |
|---|---|
| Product | Struts |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-502 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
SOURCES
Other Apache flaws
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.