CVEs / CVE-2016-8735

CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

Known exploited in the CISA KEV catalog since 12 May 2023
critical 9.8 CVSS 3.1 (NVD)
EPSS 90.3% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 24 Oct 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2016-8735

Summary

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
CISA, Known Exploited Vulnerabilities catalog

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
The CVE record, via NVD · published 6 Apr 2017 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
Apache Software Foundation Apache Tomcat	before 6.0.48	—
Apache Software Foundation Apache Tomcat	7.x before 7.0.73	—
Apache Software Foundation Apache Tomcat	8.x before 8.0.39	—
Apache Software Foundation Apache Tomcat	8.5.x before 8.5.7	—
Apache Software Foundation Apache Tomcat	9.x before 9.0.0.M12	—

As stated by OSV
Product	Affected	Fixed in
org.apache.tomcat:tomcat-catalina-jmx-remote (Maven)	before 6.0.48	6.0.48
org.apache.tomcat:tomcat-catalina-jmx-remote (Maven)	from 7.0.0, before 7.0.73	7.0.73
org.apache.tomcat:tomcat-catalina-jmx-remote (Maven)	from 8.0.0, before 8.0.39	8.0.39
org.apache.tomcat:tomcat-catalina-jmx-remote (Maven)	from 8.5.0, before 8.5.7	8.5.7
org.apache.tomcat:tomcat-catalina-jmx-remote (Maven)	from 9.0.0.M1, before 9.0.0.M12	9.0.0.M12
org.apache.tomcat:tomcat-catalina (Maven)	before 6.0.48	6.0.48
org.apache.tomcat:tomcat-catalina (Maven)	from 7.0.0, before 7.0.73	7.0.73
org.apache.tomcat:tomcat-catalina (Maven)	from 8.0.0, before 8.0.39	8.0.39
org.apache.tomcat:tomcat-catalina (Maven)	from 8.5.0, before 8.5.7	8.5.7
org.apache.tomcat:tomcat-catalina (Maven)	from 9.0.0.M1, before 9.0.0.M12	9.0.0.M12

Package versions from GHSA-cw54-59pw-4g8c.

Exploitation

In CISA KEV since	12 May 2023
Due date for US federal agencies	2 Jun 2023
Used in ransomware campaigns	Unknown
Required action	Apply updates per vendor instructions.

Severity

CVSS 3.1	9.8 critical `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` Scored by NVD

References

CVE-2016-8735 on NVD
CVE-2016-8735 in the CISA KEV catalog
https://tomcat.apache.org/security-9.html (cited by CISA)
CVE-2016-8735 on OSV
http://rhn.redhat.com/errata/RHSA-2017-0457.html Third Party Advisory
http://seclists.org/oss-sec/2016/q4/502 Mailing List, Mitigation, Third Party Advisory
http://svn.apache.org/viewvc?view=revision&revision=1767644 Broken Link, Patch
http://svn.apache.org/viewvc?view=revision&revision=1767656 Broken Link, Patch
http://svn.apache.org/viewvc?view=revision&revision=1767676 Broken Link, Patch
http://svn.apache.org/viewvc?view=revision&revision=1767684 Broken Link, Patch
http://tomcat.apache.org/security-6.html Release Notes, Vendor Advisory
http://tomcat.apache.org/security-7.html Release Notes, Vendor Advisory
http://tomcat.apache.org/security-8.html Release Notes, Vendor Advisory
http://tomcat.apache.org/security-9.html Release Notes, Vendor Advisory
http://www.debian.org/security/2016/dsa-3738 Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Patch, Third Party Advisory
http://www.securityfocus.com/bid/94463 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037331 Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0455 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0456 Third Party Advisory
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E Mailing List, Patch
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E Mailing List, Patch

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.