Apache Struts2 Vulnerability Downloaded 387K+ Times Last Week

Years-Old Apache Struts2 Vulnerability Downloaded 387K+ Times in the Past Week

January 14, 2026
By Sonatype Research Team
7 minute read time

Key Takeaways:

Apache Struts Vulnerability Downloaded at Scale

Apache Struts has a newly disclosed vulnerability, CVE-2025-68493, affecting Struts' XWork component and raising renewed concern about unsafe XML handling and XXE-style risk in certain deployments. According to NVD, affected versions span Struts 2.0.0 up to 6.1.0, with 6.1.1 identified as the fixed release.

What makes this disclosure especially urgent is what we're seeing in Maven Central download telemetry: in just the past 7 days, we observed 387,549 downloads of org.apache.struts:*, and ~98% of that activity was concentrated on end-of-life (EOL) Struts 2.x lines with only ~1.8% on Struts 6.0.0 – 6.1.0.

In this post, we'll break down what defenders need to know about the CVE, and use real ecosystem data to help you gauge exposure, prioritize upgrades, and reduce risk while remediation is underway.

A Critical Vulnerability, Before the Noise Starts

Despite the severity of CVE-2025-68493, public discussion remains relatively muted compared to previous Apache Struts disclosures. There are early advisories and technical write-ups, but no widespread panic yet.

This quiet period is familiar.

Historically, Struts vulnerabilities often follow a predictable arc: initial disclosure, slow organizational response due to upgrade complexity, and eventual attacker weaponization once proof-of-concept techniques circulate more widely.

The real risk does not emerge at disclosure. It emerges in the lag between knowing and changing what is actually deployed.

Sonatype has repeatedly observed this pattern with previous Struts vulnerabilities, including CVE-2023-50164 and CVE-2024-53677. CVE-2025-68493 shows many of the same early indicators.

Furthermore, end of life and otherwise unpatchable Apache Struts versions have presented a particularly thorny challenge for organizations for years. For example, the last supported version of Struts 2.3 has been unmaintained for 2,272 days (as of January 14, 2026), since it went end-of-life on September 21, 2018, and yet the download details indicate it still sees wide use in application environments. Including these new CVEs, the situation for old Struts is bleak. End-of-Life Security vendor HeroDevs keeps track of, and provides patches for End of Life packages like Struts.
Struts Version Youngest Branch Release Date Days Since EOL Number of Vulnerabilities Has Critical
2.0.x November 21, 2008 6263 46 Yes
2.1.x May 24, 2008 6444 43 Yes
2.2.x April 7, 2011 5396 42 Yes
2.3.x September 21, 2018 2672 12 Yes
2.5.x September 10, 2023 857 3 Yes
6.0.x June 1, 2022 1323 5 Yes

Technical Impact and Exploitation Path

CVE-2025-68493 impacts Apache Struts 2.0.0 through 6.1.0, specifically within the XWork framework that underpins Struts' action invocation and result processing. XWork's XML handling can be abused under certain configurations, reopening the door to XXE-style behavior and related resource exhaustion scenarios.

While early write-ups emphasize XML safety, the more practical concern for many deployments is service availability. Improperly constrained XML parsing can be leveraged to trigger a denial of service attack, consuming CPU or memory until the application becomes unresponsive.

If you're asking how does a denial of service attack work in this context: an attacker doesn't need remote code execution. They simply need a path to submit crafted input that forces expensive XML expansion or parsing loops — an attack pattern that has repeatedly proven effective against Struts over time, especially in environments where patching lags behind disclosure.

The Apache project has addressed this issue in Struts 6.1.1, which introduces stricter parser hardening. All prior versions should be considered vulnerable, regardless of when the underlying code was first written or patched upstream.

What Maven Central Telemetry Shows

At Sonatype, we don't just look at CVSS scores — we look at ecosystem behavior. Using Maven Central download telemetry from the past 7 days, we analyzed the usage of a set of vulnerable org.apache.struts:* artifacts to understand where the risk actually lives.

That means nearly all observed activity is tied to EOL versions, a pattern we repeatedly observe with high-profile frameworks. The fix is available in version 6.1.1, which saw 6,243 downloads over the same time period — nearly a 1:1 ratio of vulnerable to safe downloads in the past week. The issue isn't just the vulnerability — it's the long tail of dependency inertia.

AI Is Discovering Old, But Used, Open Source Vulnerabilities

One detail that makes this vulnerability especially notable is how it was discovered.

According to the Apache Struts security bulletin ( S2-069), CVE-2025-68493 was identified by Zast AI, an autonomous AI security research system. While human researchers remain critical, AI-assisted discovery is increasingly capable of identifying complex flaws faster and at greater scale.

AI changes speed, but it does not change consequences. If vulnerabilities are being discovered faster than ever, can organizations realistically keep up using traditional patch-and-upgrade workflows?

Struts is not an outlier here. It's a case study in a broader shift. As AI-driven discovery accelerates, the window between discovery and exploitation shrinks, while organizational remediation timelines often stay the same.

Keeping Up Requires More Than Advisories

As vulnerability discovery accelerates, defenders need more than CVE alerts. They need guidance at the moment when dependency decisions are made, before vulnerable components ever ship.

CVE-2025-68493 highlights a persistent problem: even when a fix in newer versions exists, vulnerable versions remain deeply embedded across the ecosystem, and can be very hard and costly to patch. As AI accelerates both vulnerability discovery and software creation, the gap between knowing and changing what's deployed continues to widen.

Written by Sonatype Research Team
Sonatype's Research Team is focused on bringing real-time, in-depth intelligence and actionable information about open source and third party vulnerabilities to Sonatype customers.