Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HSummary
CVE-2025-68493 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Apache Struts. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-68493 is a missing XML validation vulnerability, classified under CWE-611 (XML External Entity Injection), affecting Apache Struts. The issue impacts versions from 2.0.0 before 2.2.1, as well as versions from 2.2.1 through 6.1.0. Published on 2026-01-11, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H), indicating high severity due to its potential for remote exploitation with significant confidentiality and availability impacts.
Attackers can exploit this vulnerability remotely over the network without authentication privileges, though it requires user interaction, such as tricking a user into processing a malicious input. Successful exploitation enables high confidentiality loss, allowing disclosure of sensitive data, and high availability disruption, potentially leading to denial-of-service conditions, while integrity remains unaffected.
Apache advisories recommend upgrading to version 6.1.1, which resolves the issue. Additional details are available in the Apache Struts security bulletin at https://cwiki.apache.org/confluence/display/WW/S2-069 and the oss-security mailing list announcement at http://www.openwall.com/lists/oss-security/2026/01/11/2.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1898
Vulnerability Data
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.1V15.3.2
Mitigating Controls (NIST 800-53 r5) AI
Secure configuration settings can disable external entity processing in XML parsers.
Developer testing can discover XXE flaws through targeted XML parsing tests.
Input validation can reject or sanitize XML containing external entity references.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened XML parser configurations directly disable external entity resolution.
Secure SDLC practices include input validation and safe XML parser configuration that prevent XXE.
Vulnerability scanning can discover XXE flaws but does not prevent their introduction in code.
Patching eliminates XXE-vulnerable parser versions but is only one aspect of software maintenance.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches XXE via static analysis and dynamic XML fuzzing.
Vulnerability management identifies and patches XML libraries with unsafe default entity settings.
Secure development life cycle mandates input validation and entity handling that directly prevents XXE.
Application security requirements explicitly call for disabling external entity processing in XML parsers.
Secure architecture principles include safe parser configuration that mitigates external entity risks.
Secure coding standards require disabling DTDs and external entities in XML processing.