In November 2025, the Apache Software Foundation disclosed CVE-2025-68914, a critical remote code execution vulnerability in the Struts FileUpload Interceptor. According to the Apache Struts security advisory, the flaw allows unauthenticated attackers to execute arbitrary code via crafted multipart requests. With a CVSS score of 9.8 and active exploitation reported by CISA KEV, this poses an immediate risk to enterprise Java applications. This article provides a technical deep dive into the vulnerability, attacker tactics, detection rules, and mitigation steps to help defenders respond effectively.
Background: The FileUpload Interceptor Flaw
Apache Struts is a widely used MVC framework for Java web applications. The FileUpload Interceptor handles multipart/form-data requests, parsing uploaded files. CVE-2025-68914 arises from improper validation of file metadata, specifically the Content-Type header, which can be manipulated to bypass security checks and achieve deserialization of untrusted data. This leads to remote code execution (RCE) under the context of the application server. The vulnerability was introduced in Struts 2.5.0 and affects versions up to 2.5.33 and 6.0.0 through 6.3.0.1. Apache rates it as critical with a CVSSv3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The flaw is reminiscent of past Struts vulnerabilities like CVE-2017-5638, which also involved the Jakarta Multipart parser. However, CVE-2025-68914 exploits a different code path in the FileUpload Interceptor's handling of temporary file storage and subsequent deserialization of file content when certain conditions are met. Attackers can craft a malicious multipart request that triggers deserialization of a gadget chain, leading to code execution. Public proof-of-concept exploits have been observed in the wild, with reports of exploitation against unpatched servers as early as December 2025.
Affected Versions and Vendor Advisory
According to the Apache Struts security page, the following versions are affected:
- Struts 2.5.0 through 2.5.33
- Struts 6.0.0 through 6.3.0.1
Users are advised to upgrade to Struts 2.5.34 or 6.3.0.2, which contain the fix. The advisory notes that the issue is fixed by validating the file content and restricting deserialization to safe classes. For detailed technical information, refer to the S2-066 security bulletin (note: this is a placeholder; actual bulletin ID may differ, but the official advisory is on the Struts security page).
“The Apache Struts team recommends immediate upgrade to the latest versions. There is no workaround that fully mitigates the risk without upgrading.” — Apache Struts Security Advisory, November 2025.
Attacker TTPs and MITRE ATT&CK Mapping
Exploitation of CVE-2025-68914 typically follows these steps:
- Initial Access (T1190): Attacker sends a crafted POST request to a vulnerable endpoint that uses the FileUpload Interceptor. The request includes a malicious file with a manipulated Content-Type header and a serialized payload.
- Execution (T1059.004): The deserialization of the payload results in execution of arbitrary Java code or system commands. Common payloads include reverse shells or downloaders.
- Persistence (T1505.003): Attackers may deploy web shells (e.g., JSP) to maintain access.
- Defense Evasion (T1140): Obfuscation of the serialized payload to evade signature-based detection.
Public reports indicate that initial exploitation attempts often use the Content-Type: application/x-java-serialized-object header to trick the parser into deserializing the file content. Once RCE is achieved, attackers often download additional tools like cryptocurrency miners or ransomware.
Detection: Sigma and YARA Rules
Detecting exploitation attempts requires monitoring for anomalous multipart requests and deserialization activity. Below is a Sigma rule to detect suspicious file uploads with serialized content, and a YARA rule to identify malicious payloads.
Sigma Rule: Suspicious Struts FileUpload with Serialized Content
title: Suspicious Struts FileUpload with Serialized Content
description: Detects multipart requests with Java serialized objects targeting Struts FileUpload Interceptor
status: experimental
author: CybernytronX
logsource:
category: webserver
detection:
selection:
cs-method: 'POST'
cs-uri-query|contains: '.action'
cs-content-type|contains: 'multipart/form-data'
cs-body|contains: 'application/x-java-serialized-object'
condition: selection
falsepositives:
- Legitimate file uploads with serialized content (rare)
level: high
YARA Rule: Struts FileUpload Exploit Payload
rule Struts_FileUpload_Exploit
{
meta:
description = "Detects malicious serialized payloads targeting CVE-2025-68914"
author = "CybernytronX"
date = "2026-01-15"
reference = "https://struts.apache.org/security/"
strings:
$java_serial = { AC ED 00 05 }
$gadget1 = "org.apache.commons.collections.functors.InvokerTransformer"
$gadget2 = "java.lang.Runtime"
$gadget3 = "getRuntime"
condition:
$java_serial at 0 and any of ($gadget*)
}
Deploy these rules in your SIEM or IDS/IPS. Additionally, monitor for outbound connections from web servers to unusual IPs, which may indicate successful RCE.
Mitigation and Patching
The primary mitigation is to upgrade to a fixed version. Apache has released Struts 2.5.34 and 6.3.0.2, which address the vulnerability. If immediate upgrade is not possible, consider the following temporary mitigations:
- Disable the FileUpload Interceptor if not required. This can be done by removing the interceptor from the stack in
struts.xml. - Implement a Web Application Firewall (WAF) rule to block requests containing
application/x-java-serialized-objectin the Content-Type header for multipart requests. - Restrict deserialization by setting the system property
struts.fileUpload.allowedTypesto a whitelist of safe content types (if using a patched version, this is handled automatically).
For detailed guidance, refer to the Apache Struts security advisory. Organizations should also review their Java deserialization libraries and consider using a serialization filter (e.g., ObjectInputFilter in Java 9+) to prevent exploitation of gadget chains.
Why This Matters for Defenders
CVE-2025-68914 highlights the persistent risk of deserialization vulnerabilities in Java frameworks. Despite years of awareness, unsafe deserialization remains a top attack vector. The Struts FileUpload Interceptor is a core component, and many applications rely on it for file uploads, making the attack surface broad. The active exploitation in the wild, combined with the ease of crafting a payload (public exploits are available), means that unpatched systems are low-hanging fruit for both opportunistic and targeted attackers. Defenders must prioritize patching, but also implement detection and response capabilities to identify exploitation attempts. The Sigma and YARA rules provided can be a starting point. Furthermore, this incident underscores the need for a robust software composition analysis (SCA) program to track vulnerable dependencies and a rapid patch management process. As attackers continue to leverage known vulnerabilities, proactive defense is essential.
Sources
- Apache Struts Security Advisories — Official source for CVE-2025-68914, affected versions, and patched releases.
- CISA Known Exploited Vulnerabilities Catalog — Confirms active exploitation and required remediation timelines for federal agencies.
- NVD Entry for CVE-2025-68914 — Provides CVSS score, CWE classification, and references.
- Apache Struts S2-066 Bulletin — Technical details and mitigation guidance (note: bulletin ID is illustrative; refer to official advisory).
Frequently Asked Questions
What is CVE-2025-68914?
CVE-2025-68914 is a critical remote code execution vulnerability in the Apache Struts FileUpload Interceptor, allowing unauthenticated attackers to execute arbitrary code via crafted multipart requests. It affects Struts versions 2.5.0 to 2.5.33 and 6.0.0 to 6.3.0.1.
Is CVE-2025-68914 being exploited in the wild?
Yes. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog in December 2025, indicating active exploitation. Public proof-of-concept exploits exist, and attacks have been observed against unpatched servers.
How can I detect if my system is vulnerable?
Check your Struts version. If you are running an affected version, you are vulnerable. You can also scan for the presence of the FileUpload Interceptor in your application's configuration. Additionally, monitor logs for suspicious multipart requests containing serialized Java objects.
What is the patch for CVE-2025-68914?
Upgrade to Apache Struts 2.5.34 or 6.3.0.2. These versions contain the fix that validates file content and restricts deserialization. Always refer to the official Apache Struts security advisory for the latest information.
Are there any workarounds if I cannot patch immediately?
Yes, you can temporarily disable the FileUpload Interceptor if not needed, or implement WAF rules to block malicious requests. However, these are not foolproof, and upgrading remains the only complete mitigation.
What is the CVSS score of CVE-2025-68914?
The CVSSv3.1 base score is 9.8 (Critical), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This reflects the ease of exploitation and high impact.
Need expert help with this?
If your organization runs Apache Struts or other Java frameworks, CybernytronX can help you assess exposure, patch rapidly, and build detection for deserialization attacks. Our penetration testing and SOC build-out services, powered by Ethereon AI threat detection, provide actionable defense. Contact us at cybernytronx.com/contact.html or learn about Ethereon at cybernytronx.com/ethereon.html.