#RCE

Analysis · Jun 18, 2026 · Colten Anderson

Two Struts CVEs, one incomplete fix, and the enterprise Java visibility problem

CVE-2023-50164 and CVE-2024-53677 hit the same file upload component in Apache Struts, a year apart. The second arrived because the fix for the first didn't go far enough. The real exposure is organizations that don't know where Struts lives in their stack.