HIGHCVSS v3.1 8.1Actively exploited · CISA KEV since 2021-11-03Vulnerability
CVE-2018-11776
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
Properties
- Vulnerability name
- Apache Struts Remote Code Execution Vulnerability
- Epss score
- 0.99994
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2022-05-03
- Exploited euvd since
- 2021-11-03T00:00:00+00:00
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Date added
- 2021-11-03
- Score
- 8.1
- Euvd base score version
- 3.1
- Euvd vendor
- Apache Software Foundation
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 8.1
- Vendor project
- Apache
- Content hash
- c88a2c37a6282d2bb3a05a4d2e64bb6c6b0131d8ebdc1ad254faa778406d240c
- Published at
- 2018-08-22T13:29:00.753
- Euvd updated
- 2025-10-21T23:45:48+00:00
- Last modified
- 2026-06-17T01:36:34.350
- Euvd epss pct
- 99.99
- Epss percentile
- 0.99988
- Licence
- FIRST EPSS: free to use; attribution requested in publications or products (FAQ)
Related Entities (12)
AFFECTS_PRODUCT (10)
DESCRIBES (1)
INVOLVES (1)
Explore deeper with Ninja Signal's threat intelligence graph