CVE-2021-31805 Exploitation Observed — Apache Struts

Vendor	Product	Version	Status
Apache Software Foundation	Apache Struts	2.0.0 to 2.5.29	Affected

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Source	Added
KEVIntel First	2026-06-12 00:32 UTC

Operational indicators for this CVE are listed on the Detection tab.

Observed Exploitation Attempts

Exploitation attempts against this vulnerability observed first-hand by KEVIntel private honeypots over the last 30 days.

High confidence Active exploitation observed

Attempts Observed: 23

Unique Attacker IPs: 21

Attacker Countries: 🇨🇿 🇩🇪 🇪🇪 🇪🇬 🇫🇷 🇬🇧 🇮🇪 🇮🇳 🇯🇵 🇳🇱 🇸🇬 🇺🇸 🇻🇳

Sensors Observed: 5

Exploitation Attempts Over the Last 52 Days

Loading...

First observed (all time) 2026-06-12 00:32 UTC · Last observed 2026-07-30 17:15 UTC

See more exploitation detail

Pro — sensor software/region breakdown and 24h/7d window summaries.
Enterprise — raw attacker IPs, request paths, User-Agents, and payloads.

Request Enterprise Access Compare plans Create free account

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request targets: 1
Distinct User-Agents: 22

The specific request targets and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31805.yaml	Apr 25, 2025

Virtual Patch

Compensating WAF rules to help reduce exposure to this CVE. Rule content and deployable vendor exports are available with KEVIntel Enterprise.

Available

Supported Platforms

AWS WAF Cloudflare ModSecurity

Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to KEVIntel Enterprise users.

GET /api/v2/enterprise/virtual_patches?cve_id=CVE-2021-31805

Request Enterprise Access Learn About Virtual Patches

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2026-06-12 00:32:51 UTC · KEVIntel

Active exploitation observed

Recorded 2026-06-12 00:32:51 UTC · KEVIntel sensor

Proof of concept available

Recorded 2022-04-15 04:23:44 UTC · GitHub

Weaknesses (CWE)

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Scanner Integrations

Nuclei, Metasploit, and other scanner references for this CVE are listed on the Detection tab.

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

z92g/CVE-2021-31805

github · Created 2022-07-10 14:48:52 UTC · 6 stars

S2-061/S2-062 Struts2 远程命令执行漏洞 POC&EXP

aeyesec/CVE-2021-31805

github · Created 2022-04-15 16:09:52 UTC · 5 stars

PoC for CVE-2021-31805 (Apache Struts2)

Axx8/Struts2_S2-062_CVE-2021-31805

github · Created 2022-04-15 10:28:29 UTC · 11 stars

Apache Struts2 S2-062远程代码执行漏洞(CVE-2021-31805) | 反弹Shell

Wrin9/CVE-2021-31805

github · Created 2022-04-15 04:23:44 UTC · 35 stars

S2-062 (CVE-2021-31805) / S2-061 / S2-059 RCE

Apache Struts2 S2-062 - Remote Code Execution

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

22 Jun 2026 14:21 UTC about 1 month ago

22 Jun 2026 14:21 UTC · about 1 month ago

Virtual patch available

Compensating WAF rule available to block exploitation
12 Jun 2026 00:32 UTC about 2 months ago

12 Jun 2026 00:32 UTC · about 2 months ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
12 Jun 2026 00:32 UTC about 2 months ago

12 Jun 2026 00:32 UTC · about 2 months ago

Indicators of compromise added (21)

Indicators of compromise recorded
25 Apr 2025 00:00 UTC over 1 year ago

25 Apr 2025 00:00 UTC · over 1 year ago

Nuclei template available

Scanner coverage available
15 Apr 2022 04:23 UTC over 4 years ago

15 Apr 2022 04:23 UTC · over 4 years ago

Public PoC available

Public proof-of-concept code published
12 Apr 2022 15:25 UTC over 4 years ago

12 Apr 2022 15:25 UTC · over 4 years ago

CVE published

Vulnerability disclosed publicly
26 Apr 2021 00:00 UTC over 5 years ago

26 Apr 2021 00:00 UTC · over 5 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-31805

{
  "cve_id": "CVE-2021-31805",
  "title": "Forced OGNL evaluation, when evaluated on raw not validated user input in tag...",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache Struts",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.85315,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-31805

At a Glance

Affected Versions

CVE References