UpHeron
All vulnerabilities

Servers and applications

CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 12 May 2023.

Severity
Critical 9.8
Published
6 Apr 2017
Last changed
25 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
6.0.48, 7.0.73, 8.0.39, 8.5.7
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 9.0.0-milestone11
  • Version 9.0.0-milestone10
  • Version 9.0.0-milestone9
  • Version 9.0.0-milestone8
All 16 release lines
  • Every version before 6.0.48
  • From 7.0.0 before 7.0.73
  • From 8.0 before 8.0.39
  • From 8.5.0 before 8.5.7
  • Version 9.0.0
  • Version 9.0.0-milestone1
  • Version 9.0.0-milestone2
  • Version 9.0.0-milestone3
  • Version 9.0.0-milestone4
  • Version 9.0.0-milestone5
  • Version 9.0.0-milestone6
  • Version 9.0.0-milestone7
  • Version 9.0.0-milestone8
  • Version 9.0.0-milestone9
  • Version 9.0.0-milestone10
  • Version 9.0.0-milestone11

Known exploited

CISA name
Apache Tomcat Remote Code Execution Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
2 Jun 2023
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-8735
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-8735