CVE-2016-8735

KEVApache Tomcat Remote Code Execution Vulnerability

Description

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedApr 6, 2017

Last modifiedAug 25, 2026

Added to KEVMay 12, 2023

Remediation dueJun 2, 2023

References

rhn.redhat.com/errata/RHSA-2017-0457.htmlThird Party Advisory
seclists.org/oss-sec/2016/q4/502Mailing ListMitigation
svn.apache.org/viewvc?view=revision&revision=1767644Broken LinkPatch
svn.apache.org/viewvc?view=revision&revision=1767656Broken LinkPatch
svn.apache.org/viewvc?view=revision&revision=1767676Broken LinkPatch
svn.apache.org/viewvc?view=revision&revision=1767684Broken LinkPatch
tomcat.apache.org/security-6.htmlRelease NotesVendor Advisory
tomcat.apache.org/security-7.htmlRelease NotesVendor Advisory
tomcat.apache.org/security-8.htmlRelease NotesVendor Advisory
tomcat.apache.org/security-9.htmlRelease NotesVendor Advisory
debian.org/security/2016/dsa-3738Mailing ListThird Party Advisory
oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatchThird Party Advisory

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1243 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 90.3% · top 1% of all CVEs
Weakness: NVD-CWE-noinfo
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.