CVE-2020-17530 Apache Struts
| Affected software | Apache Struts |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Fixed in | 2.5.26 |
| Weakness | Expression language injection (CWE-917) |
| Published | 11 Dec 2020 |
| Updated | 13 Nov 2026 |
Description
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CWE-94 · Code injection
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 4 citations · honeypot sightings · 10 exploits · earliest 2021-04-12.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 12 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2020-12-09.
- EPSS 96% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-17530 in VulnCheck (free account), which lists 5 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 16 days | 2026-10-21 to 2026-11-11 |
| Reported exploitation | unit42.paloaltonetworks.com | /network-attack-trends-winter-2020 | 2021-04-12 |
| Reported exploitation | blog.qualys.com | /vulnerabilities-threat-research/2021/09/21/apache-struts-2-double-ognl-evaluation-vulnerability-cve-2020-17530 | 2021-09-21 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2021-11-03 |
| Reported exploitation | media.kasperskycontenthub.com | /wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf | 2023-11-09 |
| Exploit reference | VulnCheck XDB e3fa2afdc5f2 | Exploit type: initial-access | 2020-12-09 |
| Exploit reference | VulnCheck XDB bfb08d5ee460 | Exploit type: initial-access | 2020-12-10 |
| Exploit reference | VulnCheck XDB 2413521dca63 | Exploit type: initial-access | 2020-12-13 |
| Exploit reference | VulnCheck XDB dbd52a7e6d06 | Exploit type: initial-access | 2020-12-14 |
| Exploit reference | VulnCheck XDB d5f1da1e2721 | Exploit type: initial-access | 2020-12-18 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | ka1n4t/CVE-2020-17530 | 64 | 2020-12-09 |
| Nuclei | Apache Struts 2.0.0-2.5.25 - Remote Code Execution | ||
| Metasploit | Apache Struts 2 Forced Multi OGNL Evaluation (excellent rank) | ||
| GitHub PoC | S2-061 的payload，以及对应简单的PoC/Exp | 45 | 2020-12-10 |
| GitHub PoC | S2-061 CVE-2020-17530 | 29 | 2020-12-13 |
| GitHub PoC | CVE-2020-17530-strust2-061 | 7 | 2020-12-14 |
| GitHub PoC | uzzzval/CVE-2020-17530 | 5 | 2021-01-07 |
| GitHub PoC | CyborgSecurity/CVE-2020-17530 | 4 | 2020-12-30 |
| GitHub PoC | Apache Struts2框架是一个用于开发Java EE网络应用程序的Web框架。Apache Struts于2020年12月08日披露 S2-061 Struts 远程代码执行漏洞（CVE-2020-17530），在使用某些tag等情况下可能存在OGNL表达式注入漏洞，从而造成远程代码执行，风险极大。提醒我校Apache Struts用户尽快采取安全措施阻止漏洞攻击。 | 1 | 2020-12-09 |
| GitHub PoC | Vulnerable environment of CVE-2020-17530 (S2-061) for testing | 2023-08-04 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Exploitation forks a process. Blocked by the Process rule in PROTECT mode.
Only stops attacks that start a program; an expression that reads files or data directly in Java is not stopped.
The Marshal rule does not apply: rce() arms only inside a deserialization boundary.
How to mitigate CVE-2020-17530
Upgrade Apache Struts to 2.5.26 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Communications / Visualization (Apache Struts) (8.0.0-8.1.0, 8.2.0-8.2.3) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Fusion Middleware / Installation (Apache Struts2) (12.2.1.3.0, 12.2.1.4.0) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Communications / Enterprise Policy (Apache Struts2) (12.5.0) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Communications Applications / CNE (Apache Struts) (12.0.0.3.0) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Hospitality Applications / Login (Apache Struts) (5.6) Oracle MySQL / Monitoring: General (Apache Struts) (8.0.23 and prior) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Enterprise Policy (Apache Struts2) | 12.5.0 | 12.5.0 |
| Oracle Communications | Visualization (Apache Struts) | 8.0.0-8.1.0, 8.2.0-8.2.3 | |
| Oracle Communications Applications | CNE (Apache Struts) | 12.0.0.3.0 | 12.0.0.3.0 |
| Oracle Fusion Middleware | Installation (Apache Struts2) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Hospitality Applications | Login (Apache Struts) | 5.6 | 5.6 |
| Oracle MySQL | Monitoring: General (Apache Struts) | 8.0.23 and prior |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.struts:struts2-core |
2.0.0 | 2.5.26 |
unbounded |
Products and versions
9 products, 14 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | struts | generic | ≥ 2.0.0 and ＜ 2.5.30 |
| nvd | oracle | business intelligence | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | communications diameter intelligence hub | generic | 8.0.0 · 8.1.0 · 8.2.0 · 8.2.3 |
| nvd | oracle | communications policy management | generic | 12.5.0 |
| nvd | oracle | communications pricing design center | generic | 12.0.0.3.0 |
| nvd | oracle | financial services data integration hub | generic | 8.0.3 · 8.0.6 |
| nvd | oracle | hospitality opera 5 | generic | 5.6 |
| nvd | oracle | mysql enterprise monitor | generic | 8.0.23 |
| osv | org.apache.struts | struts2-core | generic | ≥ 2.0.0 and ＜ 2.5.26 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, MONITORING: GENERAL (APACHE STRUTS), HTTPS, LOGIN (APACHE STRUTS), CNE (APACHE STRUTS), NO AUTH REMOTE EXPLOIT, ENTERPRISE POLICY (APACHE STRUTS2), INSTALLATION (APACHE STRUTS2) **Products:** STRUTS2, APACHE STRUTS 2, ORACLE COMMUNICATIONS POLICY MANAGEMENT, ORACLE COMMUNICATIONS, ORACLE FUSION MIDDLEWARE, ORACLE BUSINESS INTELLIGENCE ENTERPRISE EDITION
References
Timeline
Timeline
| Published | 2020-12-11 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2021-04-12 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2021-11-03 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-11 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |