CVE-2025-68493
published 2026-01-11CVE-2025-68493: Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1…
PriorityP279high8.1CVSS 3.1
AVNACLPRNUIRSUCHINAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
22.99%
97.5th percentile
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | 2.0.0 – 2.3.37 | — |
| apache | struts | 2.5.0 – 2.5.33 | — |
| apache | struts | >= 6.0.0 < 6.1.1 | 6.1.1 |
| apache_software_foundation | apache_struts | >= 2.0.0 < 2.2.1 | 2.2.1 |
| apache_software_foundation | apache_struts | 2.2.1 – 6.1.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
path/struts2-
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache Struts2 XWork Component XML External Entity (XXE) injection (CVE-2025-68493)"; flow:established,to_server; http.uri; content:"/struts2-"; startswith; http.content_type; content:"application/xml"; http.request_body; content:"<?xml"; content:"|3c 21|ENTITY|20|"; fast_pattern; content:"SYSTEM"; distance:0; reference:url,www.gopher.security/news/critical-apache-struts-xxe-injection-vulnerability-cve-2025-68493; reference:cve,2025-68493; classtype:web-application-attack; sid:2066771; rev:1; metadata:affected_product Apache_Struts2, attack_target Server, tls_state TLSDecrypt, created_at 2026_01_15, cve CVE_2025_68493, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2026_01_15, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes
|3c 21|ENTITY|20|
- →Attack targets HTTP requests with URI starting with '/struts2-', Content-Type of 'application/xml', and a request body containing an XML external entity declaration (<!ENTITY ... SYSTEM ...)
- →The vulnerability is an XXE injection in the XWork XML configuration parsing component of Apache Struts; look for XML payloads referencing external entities in requests to Struts endpoints ↗
- →Snort/Suricata SID 2066771 (ET ruleset) covers this CVE and can be used for network-level detection
- →Rule requires TLS decryption for full coverage, as metadata indicates deployment in SSLDecrypt environments
- ·Affected versions span Apache Struts 2.0.0 through 6.1.0 (inclusive); version 6.1.1 is the fixed release ↗
- ·Red Hat notes no mitigation meeting their criteria is available for affected packages; struts2-core in Red Hat Fuse 7 is marked 'Will not fix' ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vulncheck8.1HIGH
vendor_redhat8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.struts: Apache Struts: Information disclosure and denial of service via missing XML validation
vendor_redhat·2026-01-11·CVSS 8.1
CVE-2025-68493 [HIGH] CWE-112 org.apache.struts: Apache Struts: Information disclosure and denial of service via missing XML validation
org.apache.struts: Apache Struts: Information disclosure and denial of service via missing XML validation
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
An XML processing flaw has been found in Apache Struts. Parsing of XML configuration in the XWork component does not validate XML in proper way and it's vulnerable to XML external entity (XXE) injection.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stabilit
OSV
Apache Struts 2 is Missing XML Validation
osv·2026-01-11
CVE-2025-68493 [HIGH] Apache Struts 2 is Missing XML Validation
Apache Struts 2 is Missing XML Validation
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
GHSA
Apache Struts 2 is Missing XML Validation
ghsa·2026-01-11
CVE-2025-68493 [HIGH] CWE-112 Apache Struts 2 is Missing XML Validation
Apache Struts 2 is Missing XML Validation
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
VulnCheck
Apache Struts Improper Restriction of XML External Entity Reference
vulncheck·2025·CVSS 8.1
CVE-2025-68493 [HIGH] Apache Struts Improper Restriction of XML External Entity Reference
Apache Struts Improper Restriction of XML External Entity Reference
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Affected: Apache Struts
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-20&host_type=src&vulnerability=cve-2025-68493; https://kevintel.com/CVE-2025-68493
Suricata
ET WEB_SPECIFIC_APPS Apache Struts2 XWork Component XML External Entity (XXE) injection (CVE-2025-68493)
suricata·2026-01-15·CVSS 8.1
CVE-2025-68493 [HIGH] ET WEB_SPECIFIC_APPS Apache Struts2 XWork Component XML External Entity (XXE) injection (CVE-2025-68493)
ET WEB_SPECIFIC_APPS Apache Struts2 XWork Component XML External Entity (XXE) injection (CVE-2025-68493)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache Struts2 XWork Component XML External Entity (XXE) injection (CVE-2025-68493)"; flow:established,to_server; http.uri; content:"/struts2-"; startswith; http.content_type; content:"application/xml"; http.request_body; content:"<?xml"; content:"|3c 21|ENTITY|20|"; fast_pattern; content:"SYSTEM"; distance:0; reference:url,www.gopher.security/news/critical-apache-struts-xxe-injection-vulnerability-cve-2025-68493; reference:cve,2025-68493; classtype:web-application-attack; sid:2066771; rev:1; metadata:affected_product Apache_Struts2, attack_target Server, tls_state TLSDecrypt, created_at 2026_01_15, cve CVE_2025_68493
No public exploits indexed.
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
Wiz
CVE-2025-68493 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.1
CVE-2025-68493 [HIGH] CVE-2025-68493 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68493 :
Java vulnerability analysis and mitigation
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Source : NVD
## 8.1
Score
Published January 11, 2026
Severity HIGH
CNA Score 8.1
Affected Technologies
Java
Apache Struts
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
javapackages-tools:201801::guice-testlib
javapackages-tools:201801::guice-bom
Sources
Maven Severity HIGH Has Fix Added at: Jan 14, 2026
Bugzilla
CVE-2025-68493 google-guice: Apache Struts: Information disclosure and denial of service via missing XML validation [fedora-42]
bugzilla·2026-01-12·CVSS 8.1
CVE-2025-68493 [HIGH] CVE-2025-68493 google-guice: Apache Struts: Information disclosure and denial of service via missing XML validation [fedora-42]
CVE-2025-68493 google-guice: Apache Struts: Information disclosure and denial of service via missing XML validation [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
2026-01-11
Published
Exploited in the wild