9.8 Critical Exploited

CVE-2016-8735 Apache Tomcat Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-284

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Affected products and versions

Product	Affected versions	Fixed in
Apache Tomcat	Versions not published

References

www.oracle.com www.oracle.com
www.oracle.com www.oracle.com
svn.apache.org svn.apache.org
tomcat.apache.org tomcat.apache.org
1037331 www.securitytracker.com
94463 www.securityfocus.com
DSA-3738 www.debian.org
tomcat.apache.org tomcat.apache.org
svn.apache.org svn.apache.org
tomcat.apache.org tomcat.apache.org
svn.apache.org svn.apache.org
www.oracle.com www.oracle.com
security.netapp.com security.netapp.com
tomcat.apache.org tomcat.apache.org
RHSA-2017:0457 rhn.redhat.com
RHSA-2017:0455 access.redhat.com
svn.apache.org svn.apache.org
RHSA-2017:0456 access.redhat.com
seclists.org seclists.org
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
www.oracle.com www.oracle.com
www.oracle.com www.oracle.com
[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ lists.apache.org
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org
[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ lists.apache.org
USN-4557-1 usn.ubuntu.com

Timeline

Published April 6, 2017
Added to the KEV catalogue May 12, 2023
Last modified October 21, 2025

The 141 CVEs of Apache Tomcat →

CVE-2026-103119 Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body… Not rated CVE-2026-101356 Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous… Not rated CVE-2026-101296 A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with… Not rated CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently Not rated

Track this CVE