CVE-2016-8735criticalunder attack

CVE-2016-8735: critical vulnerability in Apache Tomcat

Published · Updated

Follow this CVE+ Monitor Apache Tomcat+ Monitor org.apache.tomcat:tomcat-catalina

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 90%
from disclosure to weapon1028 days
Published on NVDApr 6
1st PoC+1028d
CISA KEV+2227d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (16 components)
Red Hat JBoss Enterprise Web Server 2 · Red Hat JBoss Web Server 3
no_fix_planned: Will not fix
Fixed
3 products (99 components)
Red Hat JBoss Web Server 3.1 for RHEL 6 · Red Hat JBoss Web Server 3.1 for RHEL 7 · Red Hat JBoss Web Server 3.1
fix ↗
Not affected
11 products (35 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Software Collections · Red Hat Enterprise Linux 5 · Red Hat JBoss Data Grid 6 · and others 6
Action required by CISAfederal deadline: 2023-06-02

Apply updates per vendor instructions.

In short

Apache Tomcat allows attackers to run malicious code remotely if JMX monitoring is enabled and the attacker can access the JMX ports. This happens because Tomcat didn't properly secure credential handling in its monitoring feature, leaving it vulnerable to unauthorized commands.

Technical detail

Remote code execution vulnerability in Apache Tomcat's JmxRemoteLifecycleListener affects versions prior to 6.0.48, 7.0.73, 8.0.39, 8.5.7, and 9.0.0.M12. Requires JMX ports to be accessible and JmxRemoteLifecycleListener enabled; the vulnerability stems from inconsistent credential type validation against Oracle's CVE-2016-3427 patch. An unauthenticated attacker with network access to JMX ports can achieve arbitrary code execution on the server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Tomcat
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Tomcat

In the same product, most dangerous first.

CVE-2017-12617HIGHCVE-2017-12617EPSS 100.0%KEVCVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2017-12615HIGHCVE-2017-12615EPSS 99.7%KEVCVE-2026-34486HIGHApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorEPSS 98.5%KEVCVE-2018-11784—CVE-2018-11784EPSS 97.7%CVE-2021-33037—Incorrect Transfer-Encoding handling with HTTP/1.0EPSS 74.7%