MSRXApache vulnerabilities being exploited
3 Apache flaws were confirmed exploited in the wild in the past 365 days, across 3 products: ActiveMQ, Struts, Tomcat. If you run any of them, patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-10-08 | CVE-2016-3081 Struts Apache Struts Command Injection Vulnerability Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. | 2026-10-11 |
| 2026-08-04 | CVE-2026-34486 Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. | 2026-08-07 |
| 2026-04-16 | CVE-2026-34197 ActiveMQ Apache ActiveMQ Improper Input Validation Vulnerability Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. | 2026-04-30 |
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.