Researchers have discovered freely available PoC code and exploit that can be used to attack unpatched security holes in Apache Struts 2.
Source: Threadpost