CVE-2017-5638Vulnerability
Apache Struts Remote Code Execution Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 4 independent sources · first reported by GreyNoise · last reported
Last reported 19 days ago
CISA KEVAdded 3 Nov 2021
Fix due 3 May 2022
Used by ransomware: knownCISA KEV catalogue
Fix due 3 May 2022
Used by ransomware: knownCISA KEV catalogue
EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 14 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 14 Oct 2026
What the reports say
4 reports, newest first · the exact sentence from each-
IQUALIF France Leak, IUT Paris Seine Breach, US IAB Auction, SMTP Credential Dump, and Apache Struts Exploit Sale“Other posts advertised an alleged 19 million SMTP credential dump and access to servers reportedly compromised through CVE-2017-5638.”
-
Bulbature, beneath the waves of GobRAT“[ok]【CVE-2017-5638】S2-045 远程代码执行漏洞2.txt2024-07-05325,963”
-
Ten Years of Resilience, Innovation & Community-Driven Defense“It all began with CVE-2017-5638, a critical vulnerability in Apache Struts 2, a popular web application framework.”
-
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day“Apache Struts — CVE-2017-5638 (OGNL Injection)”
Indicators reported together
named in the same reports- 38.60.221[.]63in 1 report
- 38.60.221[.]174in 1 report
- 38.60.223[.]51in 1 report
- 38.60.223[.]81in 1 report
- nbt201.dynamic-dns[.]netin 1 report
- eyh.ocry[.]comin 1 report
- af4ad0bd9221ffc63ae5acff4034834ain 1 report
- hxxps://38.54.85[.]21:52208/in 1 report
- 38.54.85[.]21in 1 report
- hxxps://38.60.221[.]145/static/in 1 report
- 38.60.221[.]145in 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2021-26855, CVE-2023-34362, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2019-9082, CVE-2019-13956, CVE-2021-44228, CVE-2024-1709
Thanks — we review every report.