Critical KEV + Ransomware

CVE-2017-5638

Equifax Breach via Apache Struts CVE-2017-5638 Exploitation

Vendor / product: Apache Struts

Event date: 2017-05-13

Victim organization: Equifax

Public PoC: Yes

First tracked by RiskWire: 2026-10-11

CISA KEV catalog

Added to KEV

Federal remediation due

2022-05-03 (1622 days overdue)

Ransomware campaign use

Known

CISA description

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

Required action

Apply updates per vendor instructions.

RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.