CVE-2018-11776

HIGH KEV RANSOMWARE NUCLEI LAB

Apache Struts 2 Namespace Redirect OGNL Injection

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2018-11776 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 26 public exploits from researchers including Metasploit, Mazin Ahmed, hook-s3c, including a Metasploit module exploits/multi/http/struts2_namespace_ognl. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits CVE-2018-11776, a remote code execution vulnerability in Apache Struts 2.3-2.3.4 and 2.5-2.5.16 via OGNL injection in redirect actions. It supports automatic detection of target configuration and payload delivery for Unix, Linux, and Windows systems.

Description

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Exploits (26)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/45367

This Metasploit module exploits CVE-2018-11776, a remote code execution vulnerability in Apache Struts 2.3-2.3.4 and 2.5-2.5.16 via OGNL injection in redirect actions. It supports automatic detection of target configuration and payload delivery for Unix, Linux, and Windows systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts 2.3-2.3.4, 2.5-2.5.16
No auth needed
Prerequisites: Access to a vulnerable Struts endpoint with redirect action · Network connectivity to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Mazin Ahmed · pythonremotelinux
https://www.exploit-db.com/exploits/45260

This Python script exploits CVE-2018-11776, a remote code execution vulnerability in Apache Struts2. It checks for vulnerability by injecting OGNL expressions and executes arbitrary commands if the target is vulnerable.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (versions affected by CVE-2018-11776)
No auth needed
Prerequisites: Target URL with vulnerable Struts2 endpoint · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by hook-s3c · pythonremotemultiple
https://www.exploit-db.com/exploits/45262

This exploit leverages CVE-2018-11776, a remote code execution vulnerability in Apache Struts2. It constructs an OGNL payload to execute arbitrary commands on the target system via a crafted URL, exploiting improper input validation in the Struts2 framework.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (versions 2.3 to 2.3.34, 2.5 to 2.5.16)
No auth needed
Prerequisites: Target must be running a vulnerable version of Apache Struts2 · Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP 3,480 stars
by qazbnm456 · poc
https://github.com/qazbnm456/awesome-cve-poc/tree/master/CVE-2018-11776.md

This repository provides a technical writeup and references for CVE-2018-11776, a remote code execution vulnerability in Apache Struts. It includes links to external PoC repositories and detailed analysis from Semmle QL.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts
No auth needed
Prerequisites: Apache Struts installation with vulnerable configuration
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 303 stars
by mazen160 · remote
https://github.com/mazen160/struts-pwn_CVE-2018-11776

This repository contains a Python-based exploit for CVE-2018-11776, a remote code execution vulnerability in Apache Struts2. The exploit checks for vulnerability and executes arbitrary commands via OGNL injection.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (S2-057)
No auth needed
Prerequisites: Target running vulnerable Apache Struts2 · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 123 stars
by hook-s3c · remote
https://github.com/hook-s3c/CVE-2018-11776-Python-PoC

This repository contains a working Python PoC for CVE-2018-11776, an Apache Struts2 RCE vulnerability. It includes scripts to test vulnerability and execute commands, including reverse shells, via OGNL injection in URL paths.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (2.3 to 2.3.34, 2.5 to 2.5.16)
No auth needed
Prerequisites: Misconfigured Struts2 instance with 'struts.mapper.alwaysSelectFullNamespace' set to true
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 55 stars
by 649 · remote
https://github.com/649/Apache-Struts-Shodan-Exploit

This repository contains a Python-based PoC exploit for CVE-2018-11776, targeting Apache Struts 2. It leverages Shodan for mass exploitation, verifies vulnerability before execution, and includes an OGNL payload for remote command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts 2 (versions affected by CVE-2018-11776)
No auth needed
Prerequisites: Python 3.x · Shodan API key · Vulnerable Apache Struts 2 instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 21 stars
by Ekultek · remote
https://github.com/Ekultek/Strutter

This repository contains a functional proof-of-concept exploit for CVE-2018-11776, targeting Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16. It includes a payload generator for remote code execution and integrates with the Shodan API for target discovery.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts 2.3-2.3.34, 2.5-2.5.16
No auth needed
Prerequisites: Network access to vulnerable Apache Struts instance · Shodan API key (optional, for target discovery)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 16 stars
by brianwrf · remote
https://github.com/brianwrf/S2-057-CVE-2018-11776

This repository contains a functional exploit for CVE-2018-11776, an Apache Struts2 RCE vulnerability. The exploit leverages OGNL injection to execute arbitrary commands on vulnerable systems.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts 2.3.x (specifically tested on 2.3.20 and 2.3.34)
No auth needed
Prerequisites: Target must be running a vulnerable version of Apache Struts2 · Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 15 stars
by arlyone · poc
https://github.com/arlyone/Apache-Struts-0Day-Exploit

This is a functional exploit for CVE-2018-11776, a remote code execution vulnerability in Apache Struts. It leverages OGNL injection to execute arbitrary commands on the target system.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts (versions affected by CVE-2018-11776)
No auth needed
Prerequisites: Target must be running a vulnerable version of Apache Struts · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 15 stars
by xfox64x · remote
https://github.com/xfox64x/CVE-2018-11776

This repository provides a detailed writeup and setup instructions for exploiting CVE-2018-11776, a remote code execution vulnerability in Apache Struts2. It includes steps to configure a vulnerable environment and demonstrates the exploit using an OGNL expression.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (versions up to 2.3.14)
No auth needed
Prerequisites: Vulnerable Apache Struts2 installation · Access to a vulnerable endpoint with a misconfigured action
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP 14 stars
by xbl3 · poc
https://github.com/xbl3/awesome-cve-poc_qazbnm456/tree/master/CVE-2018-11776.md

This repository provides a technical writeup and references for CVE-2018-11776, a remote code execution vulnerability in Apache Struts. It includes links to external PoC repositories and detailed analysis from Semmle QL.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts
No auth needed
Prerequisites: Apache Struts instance with vulnerable configuration
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 12 stars
by bhdresh · remote
https://github.com/bhdresh/CVE-2018-11776

This repository provides a vulnerable Docker container and PoC exploits for CVE-2018-11776, a Struts2 RCE vulnerability. It includes OGNL injection payloads to execute arbitrary commands and create files on the target system.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (2.3.14)
No auth needed
Prerequisites: Docker environment · Network access to target · Vulnerable Struts2 application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 10 stars
by jiguangsdf · remote
https://github.com/jiguangsdf/CVE-2018-11776

This repository contains a Python script that checks for the presence of CVE-2018-11776, a remote code execution vulnerability in Apache Struts2. The script sends crafted HTTP requests to detect the vulnerability by checking for specific responses.

Classification
Scanner 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Apache Struts2 (2.3 to 2.3.34, 2.5 to 2.5.16)
No auth needed
Prerequisites: Target URL with vulnerable Struts2 instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 4 stars
by knqyf263 · remote
https://github.com/knqyf263/CVE-2018-11776

This repository contains a working exploit for CVE-2018-11776, a remote code execution vulnerability in Apache Struts2. The exploit uses an OGNL payload to execute arbitrary commands on the target system.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2
No auth needed
Prerequisites: Target system running vulnerable Apache Struts2 · Network access to the target system
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP 3 stars
by HxDDD · poc
https://github.com/HxDDD/CVE-PoC/tree/main/Apache/(RCE) CVE-2018-11776.md

This repository provides a detailed technical analysis of CVE-2018-11776, including environment setup, PoC execution steps, root cause analysis, and mitigation strategies. It includes OGNL injection payloads and demonstrates RCE via curl commands.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 2.3 ~ 2.3.34, 2.5 ~ 2.5.16
No auth needed
Prerequisites: Docker environment · Apache Struts2 vulnerable version · Configuration changes in struts.xml
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 3 stars
by tuxotron · remote
https://github.com/tuxotron/cve-2018-11776-docker

This is a Go-based exploit for CVE-2018-11776, targeting Apache Struts2. It leverages OGNL injection to execute arbitrary commands on the server, demonstrating remote code execution (RCE).

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (versions affected by CVE-2018-11776)
No auth needed
Prerequisites: Vulnerable Apache Struts2 instance · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB 1 stars
by cved-sources · poc
https://github.com/cved-sources/cve-2018-11776

This repository is a stub for Cved, a tool to manage vulnerable Docker containers, referencing CVE-2018-11776. It does not contain exploit code but links to external sources for vulnerable images.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Apache Struts 2.3 - 2.3.34, 2.5 - 2.5.16
No auth needed
Prerequisites: Docker environment · Access to vulnerable image sources
devstral-2 · analyzed Feb 16, 2026 Full analysis →
gitlab WORKING POC
by drent · poc
https://gitlab.com/drent/S2-057-CVE-2018-11776

This repository contains a functional exploit for CVE-2018-11776, an Apache Struts2 RCE vulnerability. The exploit leverages OGNL injection to execute arbitrary commands on vulnerable Struts2 instances.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (versions 2.3.20, 2.3.34, and others)
No auth needed
Prerequisites: Vulnerable Struts2 application · Network access to the target
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec WORKING POC
by m4sk0ff · remote
https://github.com/m4sk0ff/CVE-2018-11776

This repository contains a functional PoC for CVE-2018-11776, an Apache Struts2 RCE vulnerability. It uses OGNL injection to disable security restrictions and execute a reverse shell via a crafted HTTP request.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts2 (versions affected by CVE-2018-11776)
No auth needed
Prerequisites: Target running vulnerable Apache Struts2 instance · Network access to the target · Listener set up on attacker's machine (10.10.0.90:4747)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by sonpt-afk · remote
https://github.com/sonpt-afk/CVE-2018-11776-FIS

This is a functional exploit for CVE-2018-11776, leveraging an OGNL injection vulnerability in Apache Struts 2 to achieve remote command execution. The payload manipulates the OGNL context to bypass security restrictions and execute arbitrary commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts 2 (versions 2.3 to 2.3.34, 2.5 to 2.5.16)
No auth needed
Prerequisites: Vulnerable Apache Struts 2 instance · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by OzNetNerd · poc
https://github.com/OzNetNerd/apche-struts-vuln-demo-cve-2018-11776

This repository provides a CloudFormation template to deploy an isolated test environment for CVE-2018-11776, an Apache Struts RCE vulnerability. It includes steps to verify vulnerability, execute an exploit, and establish a reverse shell.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts 2.3 - 2.3.34, 2.5 - 2.5.16
No auth needed
Prerequisites: AWS account · CloudFormation access · SSH key pair
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by freshdemo · remote
https://github.com/freshdemo/ApacheStruts-CVE-2018-11776

This repository contains a Python-based exploit for CVE-2018-11776, an RCE vulnerability in Apache Struts2. The exploit leverages OGNL injection to execute arbitrary commands on vulnerable systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts 2.3 to 2.3.34, 2.5 to 2.5.16
No auth needed
Prerequisites: Vulnerable Apache Struts instance · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by cucadili · poc
https://github.com/cucadili/CVE-2018-11776

This repository provides a writeup and detection methods for CVE-2018-11776, a vulnerability in Apache Struts that allows remote code execution. It includes Suricata rules and a kernel module for detecting and blocking malicious traffic.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Apache Struts 2.3 - 2.3.34, 2.5 - 2.5.16
No auth needed
Prerequisites: Network access to the target · Apache Struts application with vulnerable configuration
devstral-2 · analyzed Feb 16, 2026 Full analysis →
vulncheck_xdb WORKING POC
remote
https://github.com/ArunBhandarii/Apache-Struts-0Day-Exploit

This repository contains a functional Python exploit for CVE-2018-11776, a remote code execution vulnerability in Apache Struts. The exploit leverages OGNL injection to execute arbitrary commands on the target system.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts (versions affected by CVE-2018-11776)
No auth needed
Prerequisites: Target URL with vulnerable Apache Struts instance
devstral-2 · analyzed Feb 25, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Man Yue Mo, hook-s3c, asoto-r7, wvu · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_namespace_ognl.rb

This Metasploit module exploits CVE-2018-11776, a remote code execution vulnerability in Apache Struts 2.3-2.3.4 and 2.5-2.5.16 via OGNL injection in redirect actions. It supports automatic detection, payload delivery, and handles various target platforms.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Struts 2.3-2.3.4, 2.5-2.5.16
No auth needed
Prerequisites: Target must have a vulnerable Struts version · Access to a redirect action endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Apache Struts2 S2-057 - Remote Code Execution
HIGHby pikpikcu
Shodan: http.html:"apache struts" || http.title:"struts2 showcase" || http.html:"struts problem report"
FOFA: body="struts problem report" || title="struts2 showcase" || body="apache struts"

References (20)

Core 20
Core References
Broken Link, Mailing List, Third Party Advisory
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt
Issue Tracking, Third Party Advisory
https://cwiki.apache.org/confluence/display/WW/S2-057
Broken Link, Third Party Advisory, VDB Entry vdb-entry
http://www.securitytracker.com/id/1041888
Exploit, Third Party Advisory, VDB Entry exploit
https://www.exploit-db.com/exploits/45367/
Exploit, Third Party Advisory, VDB Entry exploit
https://www.exploit-db.com/exploits/45262/
Broken Link, Third Party Advisory, VDB Entry vdb-entry
http://www.securityfocus.com/bid/105125
Broken Link, Third Party Advisory, VDB Entry vdb-entry
http://www.securitytracker.com/id/1041547
Exploit, Third Party Advisory, VDB Entry exploit
https://www.exploit-db.com/exploits/45260/

Scores

CVSS v3 8.1
EPSS 0.9443
EPSS Percentile 100.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Lab Environment

COMMUNITY
Community Lab
docker pull tomcat:7
docker pull tomcat:7-alpine
docker pull tomcat:7.0-alpine
+19 more repos

Details

CISA KEV 2021-11-03
VulnCheck KEV 2018-12-18
InTheWild.io 2021-07-23
ENISA EUVD EUVD-2018-0582
Ransomware Use Confirmed
Status published
Products (11)
apache/struts 2.0.4 - 2.3.35
netapp/active_iq_unified_manager 7.3
netapp/active_iq_unified_manager 9.5
netapp/oncommand_insight
netapp/oncommand_workflow_automation
netapp/snapcenter
oracle/communications_policy_management < 12.5.0
oracle/enterprise_manager_base_platform 13.3.0.0
oracle/enterprise_manager_base_platform 13.4.0.0
oracle/mysql_enterprise_monitor < 3.4.9.4237
... and 1 more
Published Aug 22, 2018
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026