November 3, 2021 · Applied Cybernetics Group
CVE-2017-9805 — Apache Struts
Apache Struts Deserialization of Untrusted Data Vulnerability
- Added to KEV
2021-11-03- Federal due date
2022-05-03- Vendor
- Apache
- Product
- Struts
- EPSS
- 99.9th percentile (score 0.995, as of
2026-07-13) - NVD CVSS v3.1
- —
- Ransomware use
- Unknown
- ATT&CK
- T1059 , T1190 · signal rollup
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2017-9805
CISA short description
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Required action
Apply updates per vendor instructions.