A critical vulnerability in Apache Struts 2 is under active exploitation by treat actors attempting to achieve remote code execution (RCE). Apache Struts is a very popular Model-View-Controller (MVC) Java Framework used by developers to build enterprise web applications. The flaw, tracked as CVE-2023-50164 (CVSS: 9.8/10), was discovered by a researcher named Steven Seeley, who posted on X (Twitter) that a working proof-of-concept (PoC) exploit has already been made public. The bug is a path traversal vulnerability impacting how Struts handles file upload parameters. If successfully exploited, an attacker could gain complete control of affected systems by uploading a maliciously crafted file to the target environment, achieving arbitrary code execution. Apache Struts is a very popular framework for web application developers, and therefore is also a high-value target for attackers. This is not the first time Struts has been targeted, and in 2017 the notorious “Struts-shock” vulnerability was exploited to compromise the Equifax credit agency, exposing the credit information of nearly 150 million people. Although CVE-2023-50164 is just as destructive as the Struts-shock vulnerability, it is much harder to exploit, requiring highly sophisticated threat actors to accomplish exploitation. There is no workaround, and CTIX analysts recommend that any administrators and developers implementing Apache Strut ensure that their software has been patched.