Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Multiple Vulnerabilities (S2-075) (S2-078)

high Nessus Plugin ID 364469

Language:

Synopsis

The Apache Struts install on the remote host is affected by multiple vulnerabilities.

Description

The version of Apache Struts installed on the remote host is 2.0.0 through 2.3.37, or 2.5.0 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by multiple vulnerabilities, as referenced in the S2-075 and S2-078 advisories:

- Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. (CVE-2026-104711)

- Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.
(CVE-2026-104714)

Both issues are only exposed by specific application configurations, which Nessus cannot verify, so this finding is flagged as a potential vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache Struts version 6.12.0 / 7.4.0 or later. Alternatively, apply the workaround as referenced in the vendor's security bulletin.

Plugin Details

Severity: High

ID: 364469

File Name: struts_S2-075_S2-078.nasl

Version: 1.3

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 10/9/2026

Updated: 10/14/2026

Configuration: Enable paranoid mode, Enable thorough checks (optional)

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.57

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-104714

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:struts

Required KB Items: Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/2/2026

Vulnerability Publication Date: 10/5/2026

Reference Information

CVE: CVE-2026-104711, CVE-2026-104714

IAVA: 2026-A-1088

Detections

Analytics