CVE-2016-8735

CRITICAL KEV NUCLEI

Apache Tomcat , 7.x , 8.x , 8.5.x , 9.x <6.0.48 <7.0.73 <8.0.39 <8.5.7 - Remote Code Execution

Title source: llm

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Exploits (1)

Nuclei Templates (1)

Apache Tomcat - Remote Code Execution via JMX Ports
CRITICALby hnd3884
Shodan: product:"tomcat"

References (37)

... and 17 more

Scores

CVSS v3 9.8
EPSS 0.9379
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2023-05-12
VulnCheck KEV 2023-05-12
InTheWild.io 2023-05-12
ENISA EUVD EUVD-2022-3642
Status published
Products (39)
apache/tomcat 9.0.0 (12 CPE variants)
apache/tomcat < 6.0.48
Apache Software Foundation/Apache Tomcat 7.x before 7.0.73
Apache Software Foundation/Apache Tomcat 8.5.x before 8.5.7
Apache Software Foundation/Apache Tomcat 8.x before 8.0.39
Apache Software Foundation/Apache Tomcat 9.x before 9.0.0.M12
Apache Software Foundation/Apache Tomcat before 6.0.48
canonical/ubuntu_linux 16.04
debian/debian_linux 8.0
netapp/7-mode_transition_tool
... and 29 more
Published Apr 06, 2017
KEV Added May 12, 2023
Tracked Since Feb 18, 2026