$ cve CVE-2016-8735 JSON

CVE-2016-8735 KEV

9.8

CRITICAL · CVSS 3.1 · EPSS 90.3% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2023-06-02.

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	90.34% — more likely to be exploited than 100% of all CVEs
On CISA KEV	yes — remediate by 2023-06-02
Public exploit	none known
Published	2017-04-06
Last modified	2026-08-25

CISA KEV

Name	Apache Tomcat Remote Code Execution Vulnerability
Added	2023-05-12
Due	2023-06-02
Vendor / product	Apache / Tomcat
Ransomware use	none reported

Affected (19)

Vendor	Product
apache	tomcat
canonical	ubuntu linux
debian	debian linux
netapp	7-mode transition tool
netapp	oncommand insight
netapp	oncommand shift
netapp	snap creator framework
oracle	agile engineering data management
oracle	agile product lifecycle management
oracle	communications application session controller
oracle	communications instant messaging server
oracle	communications interactive session recorder
oracle	hospitality guest access
oracle	micros relate crm software
oracle	micros retail xbri loss prevention
oracle	mysql enterprise monitor
oracle	retail convenience and fuel pos software
oracle	transportation management
redhat	jboss enterprise web server

References

→ the Explorer · watch your stack · NVD