Critical severity · published Apr 6, 2017
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
In wildKEV
9.8
CVSS
90.3%
EPSS
Yes
On KEV
Description
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)90.3% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 12, 2023
Federal remediation dueJun 2, 2023
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
before 6.0.48; 7.x before 7.0.73; 8.x before 8.0.39; 8.5.x before 8.5.7; 9.x before 9.0.0.M12 · source: vendor, NVD, KEV
7T
7-mode Transition Tool · Netapp
All versions, or not specified · source: NVD
AE
Agile Engineering Data Management · Oracle
6.1.3; 6.2.0; 6.2.1.0 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.5; 9.3.6 · source: NVD
CA
Communications Application Session Controller · Oracle
3.7.1; 3.8.0 · source: NVD
CI
Communications Instant Messaging Server · Oracle
10.0.1 · source: NVD
CI
Communications Interactive Session Recorder · Oracle
6.0; 6.1; 6.2 · source: NVD
DL
Debian Linux · Debian
8.0 · source: NVD
HG
Hospitality Guest Access · Oracle
4.2.0; 4.2.1 · source: NVD
JE
Jboss Enterprise Web Server · Redhat
3.0.0 · source: NVD
MR
Micros Relate Crm Software · Oracle
10.8; 11.4 · source: NVD
MR
Micros Retail Xbri Loss Prevention · Oracle
10.0.1; 10.5.0; 10.6.0; 10.7.7; 10.8.0; 10.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-8735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-8735
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0457.html
Mailing List
http://seclists.org/oss-sec/2016/q4/502
Broken Link
http://svn.apache.org/viewvc?view=revision&revision=1767644
Broken Link
http://svn.apache.org/viewvc?view=revision&revision=1767656
Broken Link
http://svn.apache.org/viewvc?view=revision&revision=1767676
Broken Link
http://svn.apache.org/viewvc?view=revision&revision=1767684
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor