diff --git a/core/src/main/resources/struts-default.xml b/core/src/main/resources/struts-default.xml
index 6fafc5bec..441ae54ac 100644
--- a/core/src/main/resources/struts-default.xml
+++ b/core/src/main/resources/struts-default.xml
@@ -46,10 +46,11 @@
                 java.lang.Class,
                 java.lang.ClassLoader,
                 java.lang.Shutdown,
+                java.lang.ProcessBuilder,
                 ognl.OgnlContext,
-                ognl.MemberAccess,
                 ognl.ClassResolver,
                 ognl.TypeConverter,
+                com.opensymphony.xwork2.ognl.SecurityMemberAccess,
                 com.opensymphony.xwork2.ActionContext" />
 
     <!-- this must be valid regex, each '.' in package name must be escaped! -->
diff --git a/core/src/test/java/org/apache/struts2/views/jsp/URLTagTest.java b/core/src/test/java/org/apache/struts2/views/jsp/URLTagTest.java
index 50bf5767f..6c141aaff 100644
--- a/core/src/test/java/org/apache/struts2/views/jsp/URLTagTest.java
+++ b/core/src/test/java/org/apache/struts2/views/jsp/URLTagTest.java
@@ -657,8 +657,7 @@ public class URLTagTest extends AbstractUITagTest {
 		tag.doEndTag();
 
 		Object allowMethodAccess = stack.findValue("\u0023_memberAccess['allowStaticMethodAccess']");
-		assertNotNull(allowMethodAccess);
-		assertEquals(Boolean.FALSE, allowMethodAccess);
+		assertNull(allowMethodAccess);
 
 		assertNull(session.get("foo"));
 
diff --git a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
index 6bc6354df..b719432de 100644
--- a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
+++ b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
@@ -339,6 +339,7 @@ public class SecurityMemberAccessTest extends TestCase {
 
         // when
         boolean accessible = sma.isAccessible(context, target, member, propertyName);
+
         // then
         assertTrue(accessible);
 
@@ -388,6 +389,42 @@ public class SecurityMemberAccessTest extends TestCase {
         assertTrue(accessible);
     }
 
+    public void testAccessMemberAccessIsAccessible() throws Exception {
+        // given
+        SecurityMemberAccess sma = new SecurityMemberAccess(false);
+        Set<Class<?>> excluded = new HashSet<Class<?>>();
+        excluded.add(ognl.MemberAccess.class);
+        sma.setExcludedClasses(excluded);
+
+        String propertyName = "excludedClasses";
+        String setter = "setExcludedClasses";
+        Member member = SecurityMemberAccess.class.getMethod(setter, Set.class);
+
+        // when
+        boolean accessible = sma.isAccessible(context, target, member, propertyName);
+
+        // then
+        assertTrue(accessible);
+    }
+
+    public void testAccessMemberAccessIsBlocked() throws Exception {
+        // given
+        SecurityMemberAccess sma = new SecurityMemberAccess(false);
+        Set<Class<?>> excluded = new HashSet<Class<?>>();
+        excluded.add(SecurityMemberAccess.class);
+        sma.setExcludedClasses(excluded);
+
+        String propertyName = "excludedClasses";
+        String setter = "setExcludedClasses";
+        Member member = SecurityMemberAccess.class.getMethod(setter, Set.class);
+
+        // when
+        boolean accessible = sma.isAccessible(context, target, member, propertyName);
+
+        // then
+        assertFalse(accessible);
+    }
+
 }
 
 class FooBar implements FooBarInterface {