CVEvulnerability

CVE-2016-8735

9.8 CRITICAL Known exploited Published 2017-04-06 Modified 2026-08-25 Official page ↗

CISA Known Exploited Vulnerability

Apache Tomcat Remote Code Execution Vulnerability — Apache Tomcat

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Added to KEV
2023-05-12
Remediation due
2023-06-02
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735
Status
Analyzed
Published
2017-04-06
Last modified
2026-08-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Affected configurations

• apache tomcat (< 6.0.48) • apache tomcat (>= 7.0.0 < 7.0.73) • apache tomcat (>= 8.0 < 8.0.39) • apache tomcat (>= 8.5.0 < 8.5.7) • apache tomcat 9.0.0 • canonical ubuntu linux 16.04 • netapp 7-mode transition tool • netapp oncommand insight • netapp oncommand shift • netapp snap creator framework • debian debian linux 8.0 • redhat jboss enterprise web server 3.0.0 • oracle agile engineering data management 6.1.3 • oracle agile engineering data management 6.2.0 • oracle agile engineering data management 6.2.1.0 • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle communications application session controller 3.7.1 • oracle communications application session controller 3.8.0 • oracle communications instant messaging server 10.0.1 • oracle communications interactive session recorder 6.0 • oracle communications interactive session recorder 6.1 • oracle communications interactive session recorder 6.2 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle micros relate crm software 10.8 • oracle micros relate crm software 11.4 • oracle micros retail xbri loss prevention 10.0.1 • oracle micros retail xbri loss prevention 10.5.0 • oracle micros retail xbri loss prevention 10.6.0 • oracle micros retail xbri loss prevention 10.7.7 • oracle micros retail xbri loss prevention 10.8.0 • oracle micros retail xbri loss prevention 10.8.1 • oracle mysql enterprise monitor (<= 3.2.8.2223) • oracle mysql enterprise monitor (>= 3.3.0 <= 3.3.4.3247) • oracle mysql enterprise monitor (>= 3.4.0 <= 3.4.2.4181) • oracle retail convenience and fuel pos software 2.1.132 • oracle transportation management 6.3.0 • oracle transportation management 6.3.1 • oracle transportation management 6.3.2 • oracle transportation management 6.3.3 • oracle transportation management 6.3.4 • oracle transportation management 6.3.5 • oracle transportation management 6.3.6 • oracle transportation management 6.3.7

References