CISA added CVE-2016-3081 to its KEV catalog for active exploitation of an Apache Struts flaw enabling remote code execution.