Apache Struts remote code execution (CVE-2018-11776) — a flaw that only works when conditions line up
A remote code execution flaw in a web application framework. What marks it out is that it does not apply always: the catalog sets out two situations, each of which requires several configuration conditions to hold at the same time.
Key facts
- CVE IDCVE-2018-11776
- Affected (vendor / product)Apache Struts
- CWECWE-20
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2022-05-03 (U.S. federal civilian agencies, BOD 22-01)
Key points
- A remote code execution flaw in a web application framework, described as arising under either of two circumstances.
- Each circumstance requires several configuration conditions to hold at once, so the same product may or may not be affected.
- Written conditions give the ability to judge exposure while placing the burden of knowing your own configuration on you.
- The weakness is CWE-20, shared by 146 (8.6%) of the 1,694 records this site holds as of 2026-09-04.
- The identifier dates from 2018 and the listing from 3 November 2021; 292 (17.2%) of those same records were listed three to five years after numbering.
1Not something that always applies
Most catalog descriptions state briefly what becomes possible and stop. This one instead spells out the conditions under which the flaw exists. Two situations are given, and each requires several configuration settings to hold simultaneously. Read the other way: two organizations running the same product may or may not be affected, depending on how it is configured.
- 1The first situationA particular option is enabled, no value is set for a defined result, and the upper namespace is absent or a wildcard
- 2The second situationA URL tag is used with neither value nor action set, and the upper namespace is absent or a wildcard
- 3What they shareBoth turn on how namespace is handled in the upper package configuration
- 4The consequenceThe same product is affected or not depending on configuration
2What makes conditional flaws hard
Spelled-out conditions are both a gift and a burden. The gift is being able to determine whether you are affected. The burden is that determining it requires knowing your own configuration precisely. In an organization running many applications, establishing which settings are in force where is itself a piece of work.
The result is that conditional vulnerabilities tend to be left alone on the presumption that they probably do not apply.
3Reading the 181 days
This entry also carries 181 days, because like the previous article it belongs to the batch listed when the catalog opened. The identifier dates from 2018 and the listing from 2021, three years apart. Of those same 1,694 records, 292 (17.2%) reached the catalog three to five years after their identifier was issued.
Not everything is exploited immediately on disclosure; there is a distinct layer where confirmation arrives only later.
4What using a framework means
A web framework removes a great deal of work. In exchange, what happens inside it becomes hard to see. That a single setting can open a route nobody considered is the other face of that opacity. When a vulnerability arrives with its conditions written out, treating the reading of those conditions and the checking of your own configuration as one task is the safer habit.
Why it matters
A conditional vulnerability hands over the material for a judgment and, with it, the responsibility for making one. Stopping at the presumption that it probably does not apply, or actually checking the configuration, leads to different outcomes. Using a framework means accepting that its interior is hard to see, and skipping the step of matching stated conditions against your own setup turns that opacity directly into risk.
FAQ
If the conditions do not hold, is it safe?
Why 181 days?
Is a three-year gap unusual?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).