Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-4438

39
FAUCET Score

CVE-2016-4438 is a critical remote code execution vulnerability affecting the REST plugin in Apache Struts 2 versions 2.3.19 through 2.3.28.1. Attackers can exploit this flaw by submitting a crafted expression, leading to a complete compromise of the affected system. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Despite its high severity and EPSS score, there is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
2.3.20CPE matchmatch criteria
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*
2.3.20.1CPE matchmatch criteria
cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*
2.3.20.3CPE matchmatch criteria
cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*
2.3.24CPE matchmatch criteria
cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*
2.3.24.1CPE matchmatch criteria
cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
16.61%
Probability of exploitation in next 30 days
EPSS Percentile
96.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.1661 is in the 93rd percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

mavenpatch availablevia ghsa
Product: org.apache.struts:struts2-coreFixed in: 2.3.29
mavenpatch availablevia ghsa
Product: org.apache.struts:struts2-rest-pluginFixed in: 2.3.29

Vendor Advisories (2)

mavenGHSA-4prj-vw9j-v6prcritical

Arbitrary code execution in Apache Struts 2

May 14, 2022
redhatCVE-2016-4438Important

struts: Possible RCE via REST plugin

Jun 17, 2016

References

jvndb.jvn.jp / jvndb/JVNDB-2016-000110
VDB EntryVendor Advisory
jvn.jp / en/jp/JVN07710476/index.html
Vendor Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingThird Party AdvisoryVDB Entry
struts.apache.org / docs/s2-037.html
Vendor Advisory
oracle.com / technetwork/security-advisory/cpujul2017-3236622.html
securityfocus.com / bid/91275
Third Party Advisory