Is CVE-2012-0391 being actively exploited?

Yes. CVE-2012-0391 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on January 21, 2022.

What is the CVSS score for CVE-2012-0391?

CVE-2012-0391 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2012-0391

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 75.6%EU EUVD: exploited

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-94
EPSS score: 75.6% (100th percentile)
In CISA KEV: Yes, added January 21, 2022
In EU EUVD: Yes (EUVD-2022-2464)
Published: January 8, 2012
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Apache Struts 2 Improper Input Validation Vulnerability

Added to the KEV catalog on January 21, 2022; federal remediation due July 21, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2022-2464 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

apache / struts

References

http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html(Broken Link, Exploit)
http://secunia.com/advisories/47393(Vendor Advisory)
http://struts.apache.org/2.x/docs/s2-008.html(Vendor Advisory)
http://struts.apache.org/2.x/docs/version-notes-2311.html(Vendor Advisory)
http://www.exploit-db.com/exploits/18329(Exploit)
https://issues.apache.org/jira/browse/WW-3668(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391(US Government Resource)
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt(Broken Link, Exploit)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain