9.8

CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

KEV
Analyzed
AliasesUBUNTU-CVE-2016-8735USN-7242-1GHSA-cw54-59pw-4g8c
Published 06-04-2017Last modified 21-10-2025

Vulnerability summary

CVE-2016-8735 is a critical (CVSS 9.8) vulnerability in Apache Tomcat. It is known to be exploited: CISA lists it, first on 12-05-2023. EPSS estimates a 90.34% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Priority
Act nowlisted as exploited

Listed as exploited by CISA (12-05-2023)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
90.34%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 6
DLA-728-1DLA-729-1DSA-3738-1DSA-3739-1MGASA-2016-0417RHSA-2017:0455

Timeline

  1. 06-04-2017
    PublishedVulnerability first disclosed.
  2. 12-05-2023
    Added to CISA KEVExploitedApache Tomcat Remote Code Execution Vulnerability
  3. 02-06-2023
    CISA remediation dueDeadline passedApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

CVSS metrics

6 scores · 4 sources · 3 versions

EPSS trend

Probability

90.34%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 90.34% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
12-05-2023
Federal due date
02-06-2023
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. tomcat.apache.org/security-9.html nvd.nist.gov/vuln/detail/CVE-2016-8735

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle11 products
Netapp4 products
Ubuntu3 products
  • tomcat6< 6.0.45+dfsg-1ubuntu0.1 | < 6.0.39-1ubuntu0.1+esm2
  • tomcat7< 7.0.52-1ubuntu0.8 | < 7.0.68-1ubuntu0.3
  • tomcat8< 8.0.32-1ubuntu1.3
Org.apache.tomcat2 products
  • tomcat-catalina< 6.0.48 | ≥ 7.0.0, < 7.0.73 | ≥ 8.0.0, < 8.0.39 | ≥ 8.5.0, < 8.5.7 | ≥ 9.0.0.M1, < 9.0.0.M12
  • tomcat-catalina-jmx-remote< 6.0.48 | ≥ 7.0.0, < 7.0.73 | ≥ 8.0.0, < 8.0.39 | ≥ 8.5.0, < 8.5.7 | ≥ 9.0.0.M1, < 9.0.0.M12
Apache1 product
  • tomcat< 6.0.48 | ≥ 7.0.0, < 7.0.73 | ≥ 8.0, < 8.0.39 | ≥ 8.5.0, < 8.5.7 | 9.0.0 | 9.0.0:milestone1 | 9.0.0:milestone10 | 9.0.0:milestone11 | 9.0.0:milestone2 | 9.0.0:milestone3 | 9.0.0:milestone4 | 9.0.0:milestone5 | 9.0.0:milestone6 | 9.0.0:milestone7 | 9.0.0:milestone8 | 9.0.0:milestone9
Apache software foundation1 product
  • apache tomcat< 6.0.48 | 7.x before 7.0.73 | 8.x before 8.0.39 | 8.5.x before 8.5.7 | 9.x before 9.0.0.M12
Canonical1 product
Debian1 product
Redhat1 product

9 vendors · 25 products

References

69 links
Show all 69 references