WaratekVRT Sign in

CVE-2016-8735 Apache Tomcat

Affected softwareApache Tomcat
Severity9.8 Critical CVSS 3.1 3 scores
Fixed in6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12
WeaknessImproper access control (CWE-284)
Published6 Apr 2017
Updated13 Nov 2026

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2023-05-12 · remediation due 2023-06-02 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · earliest 2023-05-12.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 1 indexed Published artifacts you can open, in Nuclei.
  • EPSS 90% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2016-8735 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2023-05-12
Reported exploitation thedfirreport.com /2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity 2023-12-18
IndexArtifactStarsFirst seen
Nuclei Apache Tomcat - Remote Code Execution via JMX Ports

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Deserial RCE rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Deserial RCE rule

The ARMR Deserial RCE rule blocks the RCE: attackers exploit JmxRemoteLifecycleListener by sending a serialized gadget payload in place of JMX credentials, triggering ObjectInputStream.readObject() during RMI authentication.

How to mitigate CVE-2016-8735

Upgrade Apache Tomcat to a release that fixes it: 6.0.48, 7.0.73, 8.0.39, 8.5.7 or 9.0.0.M12. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2017 ↗ CPU 2017-Q4 Oracle Database Server / WLM (Apache Tomcat) (12.2.0.1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Database Server WLM (Apache Tomcat) 12.2.0.1 12.2.0.1

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.tomcat:tomcat-catalina-jmx-remote 0 6.0.48 unbounded
org.apache.tomcat:tomcat-catalina-jmx-remote 7.0.0 7.0.73 unbounded
org.apache.tomcat:tomcat-catalina-jmx-remote 8.0.0 8.0.39 unbounded
org.apache.tomcat:tomcat-catalina-jmx-remote 8.5.0 8.5.7 unbounded
org.apache.tomcat:tomcat-catalina-jmx-remote 9.0.0.M1 9.0.0.M12 unbounded
org.apache.tomcat:tomcat-catalina 0 6.0.48 unbounded
org.apache.tomcat:tomcat-catalina 7.0.0 7.0.73 unbounded
org.apache.tomcat:tomcat-catalina 8.0.0 8.0.39 unbounded
org.apache.tomcat:tomcat-catalina 8.5.0 8.5.7 unbounded
org.apache.tomcat:tomcat-catalina 9.0.0.M1 9.0.0.M12 unbounded

Products and versions

21 products, 66 version entries
SourceVendorProductSchemeAffected versions
nvd apache tomcat generic ＜ 6.0.48 · ≥ 7.0.0 and ＜ 7.0.73 · ≥ 8.0 and ＜ 8.0.39 · ≥ 8.5.0 and ＜ 8.5.7 · 9.0.0 · 9.0.0:milestone1 · 9.0.0:milestone10 · 9.0.0:milestone11 · 9.0.0:milestone2 · 9.0.0:milestone3 · 9.0.0:milestone4 · 9.0.0:milestone5 · 9.0.0:milestone6 · 9.0.0:milestone7 · 9.0.0:milestone8 · 9.0.0:milestone9
nvd canonical ubuntu linux generic 16.04
nvd debian debian linux generic 8.0
nvd netapp 7-mode transition tool generic any version
nvd netapp oncommand insight generic any version
nvd netapp oncommand shift generic any version
nvd netapp snap creator framework generic any version
nvd oracle agile engineering data management generic 6.1.3 · 6.2.0 · 6.2.1.0
nvd oracle agile product lifecycle management generic 9.3.5 · 9.3.6
nvd oracle communications application session controller generic 3.7.1 · 3.8.0
nvd oracle communications instant messaging server generic 10.0.1
nvd oracle communications interactive session recorder generic 6.0 · 6.1 · 6.2
nvd oracle hospitality guest access generic 4.2.0 · 4.2.1
nvd oracle micros relate crm software generic 10.8 · 11.4
nvd oracle micros retail xbri loss prevention generic 10.0.1 · 10.5.0 · 10.6.0 · 10.7.7 · 10.8.0 · 10.8.1
nvd oracle mysql enterprise monitor generic ≤ 3.2.8.2223 · ≥ 3.3.0 and ≤ 3.3.4.3247 · ≥ 3.4.0 and ≤ 3.4.2.4181
nvd oracle retail convenience and fuel pos software generic 2.1.132
nvd oracle transportation management generic 6.3.0 · 6.3.1 · 6.3.2 · 6.3.3 · 6.3.4 · 6.3.5 · 6.3.6 · 6.3.7
osv org.apache.tomcat tomcat-catalina generic ＜ 6.0.48 · ≥ 7.0.0 and ＜ 7.0.73 · ≥ 8.0.0 and ＜ 8.0.39 · ≥ 8.5.0 and ＜ 8.5.7 · ≥ 9.0.0 and ＜ 9.0.0
osv org.apache.tomcat tomcat-catalina-jmx-remote generic ＜ 6.0.48 · ≥ 7.0.0 and ＜ 7.0.73 · ≥ 8.0.0 and ＜ 8.0.39 · ≥ 8.5.0 and ＜ 8.5.7 · ≥ 9.0.0 and ＜ 9.0.0
nvd redhat jboss enterprise web server generic 3.0.0

References

URLTags
https://github.com/apache/tomcat/commit/0e83ad3e547fc9a75a258799ef581249b40a82a6 WEB
https://github.com/apache/tomcat/commit/292d6ccdc9edbf80859929b0af070b2ea99fa688 WEB
https://github.com/apache/tomcat/commit/7e3a037055cca4a17e90b49399fb1bab4dd7c821 WEB
https://github.com/apache/tomcat80/commit/0f76016a4ec45635e450ada9c84ff7ee0c5f3799 WEB
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E WEB

Timeline
Published2017-04-06By the CVE Program.
Added to CISA KEV2023-05-12Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2023-05-12Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2023-12-18Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-08-25NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.