Apache Software Foundation Apache Struts

Name: Apache Software Foundation Apache Struts
Brand: Apache Software Foundation

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

8critical9high5medium0low

updated 2026-10-27

vulnerabilities (29)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-5638US	critical9.8OT critical	100.0% (100th)	KEV	no fix	2017-03-11	2 versions
CVE-2018-11776US	high8.1OT critical	100.0% (100th)	KEV	no fix	2018-08-22	2 versions
CVE-2017-9805US	high8.1OT critical	99.4% (100th)	KEV	no fix	2017-09-15	≤ Apache Struts before 2.3.34 and 2.5.x before 2.5.13
CVE-2017-9791US	critical9.8OT critical	98.9% (100th)	KEV	no fix	2017-07-10	2 versions
CVE-2020-17530US	critical9.8OT critical	96.3% (100th)	KEV	no fix	2020-12-11	≤ Struts 2.0.0 - Struts 2.5.25
CVE-2017-12611US	critical9.8	87.1% (100th)	Exploit	no fix	2017-09-20	2 versions
CVE-2021-31805US	critical9.8	85.4% (100th)	Exploit	no fix	2022-04-12	≤ 2.0.0 to 2.5.29
CVE-2023-50164US	critical9.8	80.8% (100th)	Exploit	no fix	2023-12-07	2 versions
CVE-2024-53677US	critical9.8	72.4% (99th)	Exploit	6.4.0	2024-12-11	2.0.0 → 6.4.0
CVE-2025-68493US	high8.1	50.4% (99th)	Exploit	2.2.1	2026-01-11	2 versions
CVE-2026-73633US	—	0.70% (53rd)	Exploit	no fix	2026-08-14	4 versions
CVE-2017-9787US	high7.5	10.6% (96th)	—	no fix	2017-07-13	2 versions
CVE-2017-7672US	medium5.9	9.84% (96th)	—	no fix	2017-07-13	≤ 2.5 to 2.5.10.1
CVE-2017-9793US	high7.5	8.79% (95th)	—	no fix	2017-09-20	3 versions
CVE-2018-1327US	high7.5	8.65% (95th)	—	no fix	2018-03-27	≤ Apache Struts 2.1.1 to 2.5.14.1
CVE-2017-9804US	high7.5	8.24% (95th)	—	no fix	2017-09-20	2 versions
CVE-2016-6795US	critical9.8	8.22% (95th)	—	no fix	2017-09-20	2 versions
CVE-2023-41835US	high7.5	7.30% (94th)	—	no fix	2023-12-05	2 versions
CVE-2015-2992US	medium6.1	5.76% (93rd)	—	no fix	2020-02-27	≤ before 2.3.20
CVE-2023-34396US	high7.5	5.51% (93rd)	—	no fix	2023-06-14	2 versions
CVE-2023-34149US	medium6.5	5.45% (93rd)	—	no fix	2023-06-14	2 versions
CVE-2017-15707US	medium6.2	4.89% (92nd)	—	no fix	2017-12-01	≤ 2.5 to 2.5.14
CVE-2016-8738US	medium5.9	3.26% (88th)	—	no fix	2017-09-20	≤ 2.5 - 2.5.5
CVE-2025-64775US	—	1.52% (74th)	—	no fix	2025-12-01	2 versions
CVE-2025-66675US	—	0.59% (48th)	—	no fix	2025-12-10	2 versions
CVE-2026-73635US	—	0.45% (39th)	—	no fix	2026-08-15	4 versions
CVE-2026-73634US	—	0.43% (37th)	—	no fix	2026-08-15	2 versions
CVE-2026-73632US	—	0.38% (31st)	—	no fix	2026-08-15	≤ 7.2.1
CVE-2026-73631US	—	0.38% (31st)	—	no fix	2026-08-15	≤ 7.2.1

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation10 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-400Uncontrolled Resource Consumption3 CVEs
CWE-459Incomplete Cleanup3 CVEs
CWE-770Allocation of Resources Without Limits or Throttling3 CVEs
CWE-567Unsynchronized Access to Shared Data in a Multithreaded Context2 CVEs
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)29 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan