This vulnerability (CVE-2025-68493) in Apache Struts is classified under CWE-611 (Improper Restriction of XML External Entity Reference). It arises from missing XML validation in affected versions, enabling malicious XML input to exploit external entity processing. The affected versions include all releases from 2.0.0 through 6.1.0. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. The vendor advisory from Red Hat confirms the issue and recommends upgrading to Apache Struts 6.1.1 to remediate the vulnerability.

Successful exploitation can lead to high confidentiality impact (disclosure of sensitive information) and high availability impact (denial of service). The vulnerability does not affect integrity. The attack can be performed remotely without privileges but requires user interaction. This can result in significant disruption and data exposure in affected Apache Struts deployments.

A fix is available in Apache Struts version 6.1.1. Users should upgrade to this version to remediate the vulnerability. The vendor advisory from Red Hat confirms this remediation approach. No additional mitigation steps are specified or required beyond applying the official update.