Safeguard
Vulnerability Analysis•

The 2017 Equifax Breach: Apache Struts CVE-2017-5638 and Patch Management Failure

A factual look at the 2017 Equifax data breach, traced to an unpatched Apache Struts remote code execution vulnerability, and its role in shaping enterprise vulnerability management practices.

Safeguard Research Team
2 min read

The 2017 Equifax Breach: Apache Struts CVE-2017-5638 and Patch Management Failure

Summary

Equifax disclosed in September 2017 that attackers had accessed personal data of approximately 147 million people between May and July 2017. The initial access vector, per Equifax's own and congressional investigations, was an unpatched vulnerability in Apache Struts, CVE-2017-5638.

Technical Root Cause

CVE-2017-5638 was a remote code execution vulnerability in the Jakarta Multipart parser of Apache Struts, triggered by a malformed Content-Type header (CWE-20, Improper Input Validation, leading to OGNL expression injection and RCE). Apache had disclosed the vulnerability and shipped a patch in March 2017. Equifax's internal scans reportedly failed to detect the vulnerable Struts installation on the affected system, and the patch was not applied before attackers exploited it in May 2017.

Why It Mattered

The scale and sensitivity of the exposed data (Social Security numbers, birth dates, addresses, and in some cases driver's license numbers) made this one of the most consequential breaches in U.S. history at the time, leading to a $700 million settlement with the FTC and state regulators.

OWASP / CWE Mapping

  • CWE-20: Improper Input Validation
  • OWASP A06:2021: Vulnerable and Outdated Components
  • OWASP A09:2021: Security Logging and Monitoring Failures (the breach reportedly went undetected for months)

Lasting Impact

The Equifax breach is a standard case study in why automated, continuous dependency/component scanning matters more than periodic manual scans, and why patch SLAs for internet-facing systems need to be short for actively-exploited vulnerabilities.

How Safeguard Helps

Continuous SCA scanning is designed exactly to catch this failure mode — flagging vulnerable component versions like the affected Struts release automatically and repeatedly, rather than relying on a scan that can miss an installation.

References

equifaxapache-strutscve-2017-5638cwe-20data-breach
Back to all articles

More on #equifax

View all
Incident Analysis

Equifax: The Supply Chain Angle Few Talked About

7 min read

Related articles in Vulnerability Analysis

Vulnerability Analysis

MOVEit Transfer (CVE-2023-34362): A Mass Exploitation Data-Theft Campaign

A factual look at the 2023 Cl0p ransomware group campaign exploiting a SQL injection vulnerability in Progress Software MOVEit Transfer to steal data from hundreds of organizations.

September 17, 2026Read
Vulnerability Analysis

NotPetya (2017): A Supply Chain Wiper Disguised as Ransomware

A factual retrospective on the June 2017 NotPetya attack, distributed through a compromised update to Ukrainian accounting software M.E.Doc, which caused billions in damages worldwide.

September 17, 2026Read
Vulnerability Analysis

Kaseya VSA (2021): A Supply Chain Ransomware Attack via MSP Tooling

A factual look at the July 2021 Kaseya VSA supply chain attack, in which REvil affiliates exploited a zero-day to deploy ransomware through managed service provider software to downstream customers.

September 17, 2026Read

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

Book a demoGet started

No sales call required, even your agent can complete the purchase over MCP.