CVE-2026-104711

Summary

This vulnerability allows an attacker to inject malicious OGNL expressions, potentially leading to remote code execution. It matters because it can be exploited to gain full control over the affected application.

Exploitability

Exploitation is moderately hard as it requires crafting a specific request to inject an OGNL expression. The application must be configured to use the legacy RESTful action mapper and have the OGNL allowlist disabled.

Blast radius

If exploited, this can result in complete compromise of the application, including data theft, unauthorized access, and potential lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache Struts version 6.12.0 or 7.4.0, as these versions address the issue.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.