Years-Old Vulnerable Apache Struts 2 Versions See 387K Weekly Downloads

**Executive summary:** Sonatype researchers disclosed CVE-2025-68493, a CVSS 8.8 vulnerability in Apache Struts XWork that allows crafted XML input to induce an infinite-loop denial-of-service; over 387,000 downloads occurred in one week with 98% being End-of-Life vulnerable versions while only ~1.8% downloaded the patched 6.1.1, creating widespread exposure and an urgent need for updates though no active exploitation is reported.