CVE-2025-68493

high · 8.1

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

8.1

CVSS

43.3%

EPSS (exploit prob.)

99th

EPSS percentile

2026-01-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weaknesses

CWE-611CWE-112

Affected products

Vendor	Product	Affected versions
apache	struts	>= 2.0.0, <= 2.3.37
apache	struts	>= 2.5.0, <= 2.5.33
apache	struts	>= 6.0.0, < 6.1.1

Check a specific version with /api/v1/cve/match.

References

https://cwiki.apache.org/confluence/display/WW/S2-069
http://www.openwall.com/lists/oss-security/2026/01/11/2
https://access.redhat.com/security/cve/CVE-2025-68493
https://bugzilla.redhat.com/show_bug.cgi?id=2428559
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68493.json

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-68493