CVE-2025-68493highobserved exploitationCWE-112CWE-611

CVE-2025-68493: high-severity vulnerability in Apache Struts

Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

Published · Updated

Follow this CVE+ Monitor Apache Struts+ Monitor org.apache.struts:struts2-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.1epss 50%
from disclosure to weapon
Published on NVDJan 11
VulnCheck+190d
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Affected products
Apache Software Foundation · Apache Struts
Related CVEs — Apache Struts

In the same product, most dangerous first.

CVE-2017-5638CRITICALCVE-2017-5638EPSS 100.0%KEVCVE-2018-11776HIGHCVE-2018-11776EPSS 100.0%KEVCVE-2017-9805HIGHCVE-2017-9805EPSS 99.4%KEVCVE-2017-9791CRITICALCVE-2017-9791EPSS 98.9%KEVCVE-2020-17530CRITICALCVE-2020-17530EPSS 96.3%KEVCVE-2017-12611—CVE-2017-12611EPSS 87.1%