CVE-2016-3081Vulnerability

1. “CVE-2016-3081 (CVSS score of 8.1) – A command injection flaw in Apache Struts that could allow remote attackers to run arbitrary code through method: prefixes when Dynamic Method Invocation is enabled.”

   Security AffairsNews11 Oct 2026
   U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog

2. “CVE-2016-3081 (CVSS score: 8.1) - A command injection vulnerability in Apache Struts that could allow a remote attacker to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.”

   The Hacker NewsNews9 Oct 2026
   Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

3. “…nfrastructure Security Agency (CISA) has added five CVEs to its Known Exploited Vulnerabilities Catalog: CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2021-3199 CVE-2023-22894 The court-authorized seizures are the latest in a long series of US law-enforcement attempts to disrupt…”

   The Register (security)News8 Oct 2026
   US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide

4. “CVE-2016-3081*”

   The Hacker NewsNews8 Oct 2026
   FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

5. “CVE-2016-3081”

   CISA advisoriesGovernment8 Oct 2026
   Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

• dns.studiocloud[.]xyzin 1 report
• natcloudservice[.]comin 1 report
• 2.3.20[.]2in 1 report
• 2.3.24[.]1in 1 report
• 2.3.20[.]3in 1 report
• 2.3.24[.]3in 1 report
• 2.3.28[.]1in 1 report
• c0cc[.]ccin 1 report
• 98aicai[.]comin 1 report
• 98aicode[.]comin 1 report
• outlook3650[.]comin 1 report
• youtubecard[.]comin 1 report
• linkedinns[.]netin 1 report

Also named with it: CVE-2015-3306, CVE-2015-5477, CVE-2021-3199, CVE-2023-22894, CVE-2019-11510, CVE-2014-6278, CVE-2021-22205