The following two conditions must both be met for a system to be vulnerable to attack:  If your Struts application does not meet both of these conditions, your application may still be vulnerable but not (currently) exploitable via CVE-2018-11776.