Summary
- CERT-FR referenced four Apache Struts security bulletins in its 9 October advisory.
- Affected branches include Struts 6 before 6.12.0 and Struts 7 before 7.4.0.
- Organisations running unsupported Struts 2 face a separate maintenance problem.
Organisations running Apache Struts have been advised to review four newly documented security weaknesses, some of which can create routes to remote code execution, information disclosure or denial of service in affected application environments.
France’s CERT-FR published advisory CERTFR-2026-AVI-1290 on 9 October, referring to Apache bulletins S2-075 through S2-078 released on 2 October. The listed vulnerabilities are CVE-2026-104711, CVE-2026-104712, CVE-2026-104713 and CVE-2026-104714.
The French advisory identifies Struts 6 versions earlier than 6.12.0 and Struts 7 versions earlier than 7.4.0 as affected. It also includes Struts 2 and notes that the project no longer maintains that historic branch. Administrators should use each original Apache bulletin to determine which weakness is applicable to their particular applications and configurations.
Struts is a Java web application framework. Its security characteristics are especially consequential where a vulnerable application accepts input over the network and processes it through framework components. A remote execution weakness could permit an attacker to run code in the affected service’s context, while denial-of-service and disclosure issues have different prerequisites and impacts.
These distinctions prevent the vulnerabilities from being compressed into a single assertion that every Struts deployment is remotely exploitable. Whether a particular weakness can be reached depends on the framework version and affected code path, alongside the application’s implementation and deployment environment.
The dated disclosures also demonstrate a recurring challenge for organisations with longstanding Java applications. A supported Struts branch may be upgradable through a defined release path. An unsupported Struts 2 application may require a more substantial migration, potentially involving code changes and regression testing before it can receive maintained framework protection.
Where business-critical applications cannot be altered immediately, operators need to understand which services expose the vulnerable functionality and what restrictions can be applied while planning the vendor-recommended updates. Network controls and monitoring can limit some exposure but should not be presented as equivalent to fixing vulnerable application code.
There is no claim in the CERT-FR notice that the four vulnerabilities have been exploited in attacks against French or other European businesses. Its publication is a preventive warning based on disclosed weaknesses and available fixes. The article’s significance therefore lies in the potentially serious consequences of unpatched application frameworks, rather than a newly confirmed intrusion campaign.
The national advisory groups separate security bulletins for editorial convenience, not because one exploit chain uses all four flaws. A threat actor’s ability to use a particular weakness depends on the installed Struts version, application configuration and specific attack prerequisites. The reported risk categories also differ between confidentiality, availability and execution. That is why describing the entire release as one universally exploitable remote-code bug would misstate the scope of the disclosure.
Apache’s maintenance status for Struts 2 is a separate lifecycle issue. Organisations operating applications that have not migrated need to consider whether fixes are available for the branch they still run, while supported installations should be compared with the precise fixed versions in Apache’s advisories. The French notice does not document active exploitation of every flaw, and its publication date should not be mistaken for the date on which Apache first disclosed each problem.
