Apache Struts known exploited vulnerabilities, ranked
CISA lists 5 Apache Struts CVEs as exploited in the wild. 0 were added in the last 12 months and 1 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2017-5638: EPSS 100.00%, used in ransomware, added 2021-11-03
- CVE-2013-2251: EPSS 100.00%, added 2022-03-25
- CVE-2018-11776: EPSS 99.99%, added 2021-11-03
- CVE-2017-9805: EPSS 99.40%, added 2021-11-03
- CVE-2020-17530: EPSS 95.9%, added 2021-11-03
All 5 Apache Struts CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2017-5638 | Struts Remote Code Execution | 100.00% | Yes | 2021-11-03 | 2022-05-03 |
| 2 | CVE-2013-2251 | Struts Improper Input Validation | 100.00% | – | 2022-03-25 | 2022-04-15 |
| 3 | CVE-2018-11776 | Struts Remote Code Execution | 99.99% | – | 2021-11-03 | 2022-05-03 |
| 4 | CVE-2017-9805 | Struts Deserialization of Untrusted Data | 99.40% | – | 2021-11-03 | 2022-05-03 |
| 5 | CVE-2020-17530 | Struts Remote Code Execution | 95.9% | – | 2021-11-03 | 2022-05-03 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Apache KEV CVEs · other Apache products: Tomcat · free KEV badge for Apache · all vendors