CISA Flags Apache Struts CVE-2016-3081 as Actively Exploited

CISA confirms Apache Struts CVE-2016-3081 exploited in attacks

The headline today is an old bug getting fresh attention. CISA is warning that CVE-2016-3081, a command injection flaw in Apache Struts, is being exploited in attacks. It carries a CVSS of 8.1 and sits on the CISA Known Exploited Vulnerabilities list with an EPSS score around 0.96, so this is firmly in the patch now category rather than patch eventually.

The reason a 2016 CVE matters in 2026 is simple: Struts runs quietly inside a lot of internet-facing Java applications, and these are exactly the kind of long-lived assets that slip off the inventory. If you have anything running Struts, confirm the version and upgrade or isolate it now.

KEV-listed and ransomware-linked CVEs moving right now

No new KEV additions landed since the 11th, but several KEV-listed, ransomware-linked flaws are high on the exploitation charts and deserve a look if they touch your estate.

These are the ones to treat as urgent, all CISA KEV listed:

• CVE-2026-63077, JetBrains TeamCity deserialization of untrusted data, Critical, CVSS 9.8, ransomware-linked.
• CVE-2026-35273, Oracle PeopleSoft Enterprise PeopleTools missing authentication, Critical, CVSS 9.8, ransomware-linked, EPSS around 0.97.
• CVE-2026-41940, WebPros cPanel and WHM missing authentication, Critical, CVSS 9.8, ransomware-linked, EPSS around 0.99.
• CVE-2026-0257, Palo Alto Networks PAN-OS authentication bypass, Critical, CVSS 9.1, ransomware-linked.
• CVE-2015-3306, ProFTPD improper access control, Critical, CVSS 10, EPSS around 0.995.

Fresh exploitation and critical fixes from the press

SecurityWeek reports that a critical SonicWall vulnerability, CVE-2026-102255, is being exploited just days after disclosure. Short windows between disclosure and attack are the norm for perimeter gear, so SonicWall admins should apply the fix without waiting for a maintenance cycle.

On the WordPress side, SecurityWeek flags CVE-2026-85097 in the Bricksforge plugin as exploited in the wild. If you run Bricksforge, update now and check for signs of compromise.

GitLab shipped a fix for CVE-2026-97229, a critical flaw enabling arbitrary code execution on servers, and CERT-EU issued advisory 2026-016 covering it for both Community and Enterprise editions. IBM also patched 22 Verify Access flaws including critical remote code execution bugs tracked as CVE-2026-78401 and CVE-2026-78406. Separately, a Power BI phishing campaign is deploying rogue ScreenConnect RMM clients for persistent access, which is worth a Defender hunt for unexpected remote management tooling.

Microsoft housekeeping that affects patching

Two reminders from the Microsoft side. Help Net Security notes that Windows PCs missing key updates could lose security fixes in 2027 due to update certificate rotation, so devices that fall behind now may be unable to receive patches later. BleepingComputer reports Windows 11 23H2 reaches end of support in 30 days, which should push any lingering upgrade plans forward.

Admins are also seeing an Exchange Admin Center issue blocking web portal access with an Internal Server Error, so if your team hit that, it is a known problem rather than a breach.

Do this first

Work the exploited and KEV-linked items in order of what you actually run.

• Inventory and patch Apache Struts for CVE-2016-3081; it is actively exploited and KEV listed.
• Patch SonicWall (CVE-2026-102255) and Bricksforge (CVE-2026-85097) now given live exploitation.
• Apply the GitLab fix for CVE-2026-97229 and the IBM Verify Access updates.
• Confirm your Windows patch state against the KEV-flagged rollups such as KB5046616 for Windows Server 2022 and KB5046617 for Windows 11 24H2. Senserva's free Microsoft Patch Tracker ranks open Microsoft patches by CISA KEV, EPSS, and ransomware linkage so you can sort by what is being exploited.
• For the non-Microsoft KEV movers like TeamCity, PeopleSoft, cPanel, and PAN-OS, Senserva's exploited-CVE tracker follows CISA KEV additions daily.

Sources

• Cyber Security News: CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks (2026-10-12)
• SecurityWeek: Critical SonicWall Vulnerability Exploited Days After Disclosure (2026-10-12)
• SecurityWeek: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild (2026-10-12)
• Cyber Security News: Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers (2026-10-12)
• Cyber Security News: IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs (2026-10-12)
• Cyber Security News: Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access (2026-10-12)
• Cyber Security News: Microsoft Exchange Admin Center Issue Blocks Web Portal Access to Admins With “Internal Server Error” (2026-10-12)
• Help Net Security: Windows PCs missing key updates could lose security fixes in 2027 (2026-10-12)
• BleepingComputer: Microsoft: Windows 11 23H2 reaches end of support in 30 days (2026-10-12)
• CERT-EU: 2026-016: Critical Vulnerability in GitLab CE and EE (2026-10-12)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-13.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.