VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 02:44 UTC

CVE-2018-11776

Read full description

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

CVSS 8.1 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.7/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.1: +1.21
Fresh EPSS: 100.00%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Qualys

Press · 22 Feb 2022, 08:00 · Managing CISA Known Exploited Vulnerabilities with Qualys VMDR - Qualys

Qualys

Press · 27 Oct 2021, 07:00 · Apache Tomcat HTTP Request Smuggling Vulnerability (CVE-2021-33037) - Qualys

The Hacker News

Press · 23 Aug 2021, 07:00 · Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems - The Hacker News

Google Cloud

Press · 13 Apr 2020, 07:00 · Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two - Google Cloud

Unit 42

Press · 17 Dec 2018, 09:24 · Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776 - Unit 42

See all 10 source documents

Rapid7

Press · 14 Sep 2018, 07:00 · Metasploit Wrapup 9/14/18 - Rapid7

Qualys

Press · 24 Aug 2018, 07:00 · Detecting Apache Struts 2 Namespace RCE: CVE-2018-11776 - Qualys

Krebs on Security

Press · 23 Aug 2018, 07:00 · Experts Urge Rapid Patching of ‘Struts’ Bug - Krebs on Security

Sonatype

Press · 23 Aug 2018, 07:00 · Deja Vu All Over Again: Another New Apache Struts Vulnerability (CVE-2018-11776) - Sonatype

Computer Weekly

Press · 23 Aug 2018, 07:00 · Apache Struts users urged to update due to new security flaw - Computer Weekly

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.7 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 6 repos with metrics

Repository	Stars	Forks	Language	Updated
hook-s3c/CVE-2018-11776-Python-PoC	123	49	Python	25 Aug 2018, 02:14
xfox64x/CVE-2018-11776	15	6	—	25 Nov 2019, 21:21
Fnzer0/S2-057-poc	13	4	Python	31 Aug 2018, 01:58
HxDDD/CVE-PoC	3	0	—	20 Apr 2022, 00:23
jezzus/CVE-2018-11776-Python-PoC	0	0	—	06 Sep 2018, 23:49
m4sk0ff/CVE-2018-11776	0	0	Python	09 Sep 2025, 13:39

Public exploit evidence

exploitdb #45260 2018-08-26
exploitdb #45262 2018-08-25
exploitdb #45367 2018-09-10

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.1; EPSS 100.0%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction, additional attack conditions.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:55.555769+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

22 Aug 2018, 13:00

First press mention

23 Aug 2018, 07:00

Added to the CISA KEV catalog

03 Nov 2021, 00:00

Latest press mention

22 Feb 2022, 08:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

6 repositories