CVE-2025-68493: 
Java vulnerability analysis and mitigation

CVE-2025-68493 is an XXE (XML External Entity) injection vulnerability in the XWork component of Apache Struts, tracked under security bulletin S2-069. It affects Apache Struts versions 2.0.0 through 2.3.37 (EOL), 2.5.0 through 2.5.33 (EOL), and 6.0.0 through 6.1.0, and was publicly disclosed on January 11, 2026. The vulnerability was reported by ZAST.AI and assigned a CVSS v3.1 base score of 8.1 (High) (Apache S2-069, Openwall OSS-Sec).

The root cause is improper XML validation in the XWork component's XML configuration parser, classified as CWE-611 (Improper Restriction of XML External Entity Reference). When parsing XML configuration, the XWork component fails to disable external entity processing, allowing an attacker to inject malicious XML payloads containing external entity references. Exploitation requires user interaction (e.g., a user or application processing attacker-controlled XML input) and no authentication or special privileges. The vulnerability enables classic XXE attack patterns including file disclosure, SSRF, and denial of service (Apache S2-069, Openwall OSS-Sec).

Successful exploitation can result in disclosure of sensitive data (high confidentiality impact), denial of service (high availability impact), and Server-Side Request Forgery (SSRF), which could enable lateral movement to internal network resources. Integrity is not directly impacted. Given Apache Struts' widespread use in enterprise Java web applications, the potential exposure of sensitive server-side files (e.g., /etc/passwd, application configuration files) and the ability to probe internal services via SSRF represent significant risks (Apache S2-069, Red Hat Bugzilla).

1. Reconnaissance: Identify Apache Struts-based web applications using tools like Shodan, Censys, or FOFA, filtering for versions 2.0.0–2.3.37, 2.5.0–2.5.33, or 6.0.0–6.1.0.
2. Craft malicious XML payload: Construct an XML document containing an external entity declaration pointing to a target resource (e.g., a local file or internal HTTP endpoint):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

3. Deliver payload: Submit the malicious XML to an endpoint in the Struts application that processes XML configuration or user-supplied XML input via the XWork component.
4. Trigger XXE processing: The vulnerable XWork XML parser resolves the external entity reference, reading the target file or making an outbound HTTP request to an internal service.
5. Exfiltrate data or pivot: Retrieve the disclosed file contents from the application's response (in-band XXE), or use SSRF to probe internal network services and escalate access (Apache S2-069, Openwall OSS-Sec).

• Network: Unexpected outbound HTTP/HTTPS requests from the Struts application server to internal IP addresses or unusual external hosts (indicative of SSRF); DNS lookups for attacker-controlled domains originating from the application server.
• Logs: Application or web server access logs showing requests with XML bodies containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords; error logs referencing XML parsing exceptions or external entity resolution failures in XWork components.
• File System: Unexpected access to sensitive files (e.g., /etc/passwd, /etc/shadow, application configuration files) by the Java process running Struts.
• Process: Unusual outbound network connections initiated by the JVM process (e.g., java) to internal RFC-1918 addresses or unexpected external endpoints (Apache S2-069, Emerging Threats).

The primary remediation is to upgrade Apache Struts to version 6.1.1 or later. For the EOL 2.3.x series, upgrade to 2.3.38+; for the EOL 2.5.x series, upgrade to 2.5.34+. Organizations unable to upgrade immediately can apply the following JVM-level workarounds to disable external entity processing:

• Set JVM system properties: -Djavax.xml.accessExternalDTD="" -Djavax.xml.accessExternalSchema="" -Djavax.xml.accessExternalStylesheet=""
• Alternatively, configure a custom SAXParserFactory by setting xwork.saxParserFactory to a factory class that disables external entities by default.

Note that the 2.3.x and 2.5.x branches are end-of-life and migration to the 6.x series is strongly recommended (Apache S2-069).

The vulnerability received notable coverage from security media outlets including GBHackers, CyberSecurityNews, SC Magazine, and SecurityOnline, with headlines emphasizing the risk of data theft and SSRF. Sonatype reported that vulnerable Apache Struts 2 versions were downloaded approximately 325,000–387,000 times in the week following disclosure, highlighting the scale of continued use of unpatched versions (Sonatype Blog, Hackread). HeroDevs published analysis noting the vulnerability as a broader warning sign about legacy Struts deployments (HeroDevs Blog). Check Point and NSFOCUS also published advisories covering the vulnerability.