[NEW] [medium] Apache Struts: Multiple vulnerabilities

mediumpublic exploitCVE-2026-73631 CVE-2026-73632 CVE-2026-73633 CVE-2026-73634 CVE-2026-73635

A remote, anonymous attacker can exploit multiple vulnerabilities in Apache Struts to bypass security measures, disclose and manipulate data or cause a denial of service.

CSIRTS triage

vendor: Apache product: Struts Authentication bypass Information disclosure Code injection Denial of service

What: Multiple vulnerabilities in Apache Struts allow remote bypass of security measures, data disclosure and manipulation, and denial of service.
Who is affected: Apache Struts deployments accessible to remote anonymous attackers are affected.
Urgency: Moderate; remote attackers can bypass security and manipulate data but no active exploitation reported.
Action: Update Apache Struts to the latest patched version addressing CVE-2026-73631 through CVE-2026-73635.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Struts

Get an email when a new Struts advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-08-17
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2848

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-736310.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-736320.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-736330.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-736340.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-736350.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-73631	coverage & exploitation status	NVD · CVE.org
CVE-2026-73632	coverage & exploitation status	NVD · CVE.org
CVE-2026-73633	coverage & exploitation status	NVD · CVE.org
CVE-2026-73634	coverage & exploitation status	NVD · CVE.org
CVE-2026-73635	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Apache Struts

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-73635: Allocation of resources without limits or throttling vulnerability in Apache Struts. When no f…nvd · 2026-08-15
unknownCVE-2026-73634: Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes …nvd · 2026-08-15
unknownCVE-2026-73632: Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. P…nvd · 2026-08-15
unknownCVE-2026-73631: Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. P…nvd · 2026-08-15
highCVE-2026-73633: Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an a…nvd · 2026-08-14
unknownVulnerability in Apache Struts 2 (December 13, 2023)cert-fr-alerte · 2023-12-13