CVE-2016-4437 Apache Shiro
| Affected software | Apache Shiro |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Fixed in | 1.2.5 |
| Weakness | Improper access control (CWE-284) |
| Published | 7 Jun 2016 |
| Updated | 30 Oct 2026 |
Description
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CWE-321
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 4 citations · honeypot sightings · 5 exploits · earliest 2021-11-03.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 9 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2020-05-01.
- EPSS 93% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2016-4437 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 2 days | 2026-10-24 to 2026-11-04 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2021-11-03 |
| Reported exploitation | securelist.com | /strikeshark-campaign/120326 | 2026-06-24 |
| Reported exploitation | hkcert.org | /blog/strikeshark-campaign-exploits-known-vulnerabilities-to-deploy-cobalt-strike-via-sharkloader | 2026-07-16 |
| Reported exploitation | hunt.io | /blog/chinese-operator-secflow-claude-qwen-deepseek-asia | 2026-09-03 |
| Exploit reference | VulnCheck XDB 67abb858193d | Exploit type: initial-access | 2020-05-27 |
| Exploit reference | VulnCheck XDB 6535af761e5c | Exploit type: initial-access | 2021-12-23 |
| Exploit reference | VulnCheck XDB c53d22555992 | Exploit type: initial-access | 2024-01-15 |
| Exploit reference | VulnCheck XDB d7a43fa66a9e | Exploit type: initial-access | 2024-10-21 |
| Exploit reference | VulnCheck XDB fbda2202aab2 | Exploit type: initial-access | 2026-10-09 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2016-4437-Shiro反序列化爆破模块和key,命令执行，反弹shell的脚本 | 55 | 2020-05-27 |
| GitHub PoC | 一个针对shiro反序列化漏洞(CVE-2016-4437)的快速利用工具/A simple tool targeted at shiro framework attacks with ysoserial. | 24 | 2021-12-23 |
| GitHub PoC | Python POC to Exploit CVE-2016-4437 Apache Shiro Deserialization Vulnerability Due to Hardcode Encryption Key | 2 | 2023-12-22 |
| GitHub PoC | 这是基于cve-2016-4437简单的漏洞复现代码 | 1 | 2026-02-19 |
| GitHub PoC | Vulhub shiro/CVE-2016-4437: Shiro 1.2.4 rememberMe deserialization, run with Isoloom | 2026-10-08 | |
| GitHub PoC | 1.验证CVE-2016-4437、2.解析rememberMe的文件和CBC加密的IV偏移 | 2024-01-15 | |
| Exploit-DB | Apache Shiro 1.2.4 - Cookie RememberME Deserial RCE (Metasploit) | 2020-05-01 | |
| Nuclei | Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability | ||
| Metasploit | Apache Shiro v1.2.4 Cookie RememberME Deserial RCE (excellent rank) |
Waratek protection
Waratek has a rule that blocks the main way to exploit this vulnerability, but a public exploit or tool gets past it.
- Protection partial Deserialization, Process
- Action available security rule
- Review automated AI triage
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | An AI triage run found this CVE partially protected by the ARMR Deserialization of Untrusted Data and Process Forking rules: a public exploit or tool reaches the rated impact without tripping it. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: Deserialization of Untrusted Data and Process Forking rules
Shiro ships with a built-in encryption key, so anyone can forge its rememberMe cookie and hide a malicious Java object inside it, which Shiro then unpacks and runs. In the Portal's Rules Wizard, add a Deserialization of Untrusted Data rule with Remote code execution selected and the action set to Protect: it stops the object the moment it tries to start a program, which is what every public exploit does, and there is nothing else to configure. A Process Forking rule set to Protect on /bin/* and /usr/bin/* adds a second layer. The deserialization rule only blocks a fixed list of risky actions while the object is being unpacked, such as starting a program or changing system settings, so a variant that instead loads a hidden webshell into the running application gets through, and so does a forged cookie that simply logs the attacker in as someone else.
How to mitigate CVE-2016-4437
Upgrade Apache Shiro to 1.2.5 or later. Until you can, Waratek RASP blocks the main way to exploit it with its deserialization and process rules, but a public exploit or tool gets past it. The research note above says which.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 6.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.shiro:shiro-core |
0 | 1.2.5 |
unbounded |
Products and versions
5 products, 5 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | aurora | generic | ≥ 0.10.0 and ＜ 0.18.1 |
| nvd | apache | shiro | generic | ＜ 1.2.5 |
| osv | org.apache.shiro | shiro-core | generic | ＜ 1.2.5 |
| nvd | redhat | fuse | generic | 1.0 |
| nvd | redhat | jboss middleware text-only advisories | generic | 1.0 |
References
Timeline
Timeline
| Published | 2016-06-07 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2021-11-03 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2021-11-03 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-10-30 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-11-04 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |