Apache Tomcat Remote Code Execution Vulnerability

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

cat cve-2016-8735.json

Vendor: Apache
Product: Tomcat
CVSS: 9.8
EPSS (exploit probability): 90.3%
Status: kev
CISA patch-by (BOD 22-01): June 2, 2023
Published: May 12, 2023
Source: https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn’t updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Added to CISA’s Known Exploited Vulnerabilities catalog on 2023-05-12. Required action per CISA: Apply updates per vendor instructions. Due date: 2023-06-02.

This is an auto-synced KEV catalog record pending a full 0dayNews write-up — see CISA’s KEV catalog and the NVD record linked above for primary sources.