What’s Vulnerable › Vulnerabilities

CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-05-12
• EPSS: 90.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-04-06 · updated 2026-08-25

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Affected products

• Apache Tomcat: before 6.0.48; from 7.0.0 before 7.0.73; from 8.0 before 8.0.39; from 8.5.0 before 8.5.7; 9.0.0, 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone2, 9.0.0-milestone3 (+6) — fixed in 6.0.48, 7.0.73, 8.0.39, 8.5.7
• Canonical Ubuntu Linux: 16.04
• Debian Linux: 8.0
• NetApp 7-Mode Transition Tool: all versions
• OnCommand Insight: all versions
• NetApp Oncommand Shift: all versions
• NetApp Snap Creator Framework: all versions
• Oracle Corporation Oracle Agile Engineering Data Management: 6.1.3, 6.2.0, 6.2.1.0
• Oracle Corporation Oracle Agile PLM: 9.3.5, 9.3.6
• Oracle Communications Application Session Controller: 3.7.1, 3.8.0
• Oracle Communications Instant Messaging Server: 10.0.1
• Oracle Corporation Communications Interactive Session Recorder: 6.0, 6.1, 6.2
• Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
• Oracle Micros Relate Crm Software: 10.8, 11.4
• Oracle Micros Retail Xbri Loss Prevention: 10.0.1, 10.5.0, 10.6.0, 10.7.7, 10.8.0, 10.8.1
• Oracle Corporation MySQL Enterprise Monitor: through 3.2.8.2223; from 3.3.0 through 3.3.4.3247; from 3.4.0 through 3.4.2.4181
• Oracle Retail Convenience And Fuel Pos Software: 2.1.132
• Oracle Corporation Transportation Management: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5 (+2)
• Red Hat JBoss Enterprise Web Server: 3.0.0

How to fix

Upgrade to a fixed version: Apache Tomcat 6.0.48, 7.0.73, 8.0.39, 8.5.7. Check the vendor advisory for mitigations.

References

• http://rhn.redhat.com/errata/RHSA-2017-0457.html
• http://seclists.org/oss-sec/2016/q4/502
• http://svn.apache.org/viewvc?view=revision&revision=1767644
• http://svn.apache.org/viewvc?view=revision&revision=1767656
• http://svn.apache.org/viewvc?view=revision&revision=1767676
• http://svn.apache.org/viewvc?view=revision&revision=1767684
• http://tomcat.apache.org/security-6.html
• http://tomcat.apache.org/security-7.html
• http://tomcat.apache.org/security-8.html
• http://tomcat.apache.org/security-9.html
• http://www.debian.org/security/2016/dsa-3738
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Get alerted when CVE-2016-8735 or the next vulnerability affects your stack