CVE-2016-8735

CRITICAL(9.8)KEVLikely Exploited

Apache Tomcat Remote Code Execution Vulnerability

Description

CVE-2016-8735 is a critical remote code execution vulnerability in Apache Tomcat affecting versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12. The vulnerability exists because the JmxRemoteLifecycleListener component was not updated to address the credential type handling changes introduced by Oracle's patch for CVE-2016-3427. When the JmxRemoteLifecycleListener is used and an attacker can reach the JMX ports, remote code execution is possible without authentication. With a CVSS score of 9.8 (Critical) and an EPSS score of 93.7% (99th percentile), CVE-2016-8735 represents an extreme risk. CISA has confirmed active exploitation in the wild, and the vulnerability affects a broad ecosystem of products including Canonical Ubuntu, NetApp, Debian, Red Hat, and numerous Oracle enterprise applications.

KEV Information

Vendor
Apache
Product
Tomcat
Date Added
May 12, 2023
Due Date
June 2, 2023
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

Affected Products

VendorProductVersion
apachetomcat< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; 9.0.0
canonicalubuntu linux16.04
netapp7-mode transition tool-
netapponcommand insight-
netapponcommand shift-
netappsnap creator framework-
debiandebian linux8.0
redhatjboss enterprise web server3.0.0
oracleagile engineering data management6.1.3; 6.2.0; 6.2.1.0
oracleagile plm9.3.5; 9.3.6
oraclecommunications application session controller3.7.1; 3.8.0
oraclecommunications instant messaging server10.0.1
oraclecommunications interactive session recorder6.0; 6.1; 6.2
oraclehospitality guest access4.2.0; 4.2.1
oraclemicros relate crm software10.8; 11.4
oraclemicros retail xbri loss prevention10.0.1; 10.5.0; 10.6.0; 10.7.7; 10.8.0; 10.8.1
oraclemysql enterprise monitor<= 3.2.8.2223; >= 3.3.0, <= 3.3.4.3247; >= 3.4.0, <= 3.4.2.4181
oracleretail convenience and fuel pos software2.1.132
oracletransportation management6.3.0; 6.3.1; 6.3.2; 6.3.3; 6.3.4; 6.3.5; 6.3.6; 6.3.7

Multiple CVSS Assessments

Source: [email protected](Primary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

No specific CWE has been assigned to CVE-2016-8735 in the NVD database. However, the underlying issue relates to improper credential handling in the JMX remote lifecycle listener, which failed to incorporate security fixes from CVE-2016-3427. This effectively creates an access control bypass that enables unauthenticated remote code execution through exposed JMX ports.

Impact Analysis

Attack Vector (Network): CVE-2016-8735 is remotely exploitable without physical access, requiring only network connectivity to the exposed JMX ports on the target Apache Tomcat server. Attack Complexity (Low): Exploitation requires no special conditions, timing, or preparation beyond network access to the JMX interface. Privileges Required (None): No authentication credentials are needed to exploit this vulnerability, making it accessible to any unauthenticated attacker. User Interaction (None): No action from a legitimate user or administrator is required. Confidentiality, Integrity, and Availability (All High): Successful exploitation achieves complete system compromise, allowing the attacker to read all accessible data, modify or delete files and configurations, and disrupt the availability of the Tomcat server and underlying system. The CVSS score of 9.8 (Critical) reflects the maximum severity given the combination of trivial exploitability and total system impact. The EPSS score of 93.7% (99th percentile) indicates near-certain exploitation activity, and CISA has confirmed active exploitation in the wild, making this vulnerability an immediate patching priority.

Exploit Maturity

Active exploitation of CVE-2016-8735 has been confirmed by CISA, which added this critical Apache Tomcat vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 93.7% places this vulnerability in the 99th percentile, indicating near-certain exploitation activity. While no references in the NVD data are specifically tagged as "Exploit," the vulnerability is directly related to CVE-2016-3427 (the Oracle Java JMX vulnerability), and exploit techniques developed for that vulnerability are applicable here due to the shared JMX credential handling flaw. When combined with CVE-2016-3427, which addresses the same JMX credential type issue in Oracle Java, attackers targeting JMX-enabled Tomcat deployments have a well-understood attack surface. The ransomware usage status is currently unknown, but the ability to achieve unauthenticated remote code execution on widely deployed web application servers makes CVE-2016-8735 a high-value target for ransomware operators and other threat actors.

Remediation

  1. Upgrade Apache Tomcat immediately as directed by CISA's required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Update to Tomcat 6.0.48, 7.0.73, 8.0.39, 8.5.7, or 9.0.0.M12 or later, depending on your major version branch.
  2. Disable JmxRemoteLifecycleListener if it is not required for your deployment. Remove or comment out the JmxRemoteLifecycleListener configuration from your server.xml file. If JMX remote monitoring is needed, use Java's built-in JMX remote configuration with proper authentication and SSL/TLS instead.
  3. Block JMX port access at the network level by configuring firewall rules to prevent external access to JMX ports (typically 1099 and any custom RMI ports). JMX management interfaces should never be exposed to untrusted networks. Apply network segmentation to isolate application servers.
  4. Apply downstream vendor patches for affected products: Canonical Ubuntu (USN-4557-1), Debian (DSA-3738), Red Hat JBoss Enterprise Web Server (RHSA-2017:0455, RHSA-2017:0456, RHSA-2017:0457), NetApp (NTAP-20180607-0001), and Oracle products per their quarterly Critical Patch Updates (CPUJan2018, CPUJul2018, CPUOct2017, CPUApr2019, CPUJul2019).
  5. Audit all Tomcat instances for JMX exposure by scanning for open JMX ports across your infrastructure and reviewing server.xml configurations for JmxRemoteLifecycleListener usage. Implement centralized monitoring to detect unauthorized JMX connections and ensure all Tomcat instances are running patched versions.

Technical Details

Vulnerability mechanism: CVE-2016-8735 stems from Apache Tomcat's JmxRemoteLifecycleListener not being updated to align with the security fix in Oracle's CVE-2016-3427 patch, which modified how JMX credential types are processed. The JmxRemoteLifecycleListener in Tomcat continued to use the pre-patch credential handling behavior, creating an access control bypass on the JMX interface that allows unauthenticated remote code execution. Exploitation technique: An attacker who can reach the JMX ports on a Tomcat server configured with JmxRemoteLifecycleListener can exploit the inconsistent credential handling to interact with the JMX MBean server without proper authentication, ultimately executing arbitrary code on the server. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that this is a network-accessible vulnerability with no barriers to exploitation and complete system compromise potential. Relationship to CVE-2016-3427: This vulnerability is a direct consequence of Apache Tomcat's failure to incorporate Oracle's April 2016 Critical Patch Update changes for the JMX component, making it essential to address both CVE-2016-3427 (at the JDK level) and CVE-2016-8735 (at the Tomcat level) to fully secure JMX-enabled deployments.

Frequently Asked Questions

Is CVE-2016-8735 being actively exploited?

Yes, CVE-2016-8735 is confirmed to be actively exploited in the wild. CISA has added this Apache Tomcat vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 93.7% (99th percentile) indicates near-certain exploitation activity, making immediate patching essential.

What products are affected by CVE-2016-8735?

CVE-2016-8735 affects Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12. Numerous downstream products are also affected, including Canonical Ubuntu Linux, Debian, Red Hat JBoss Enterprise Web Server, NetApp products (OnCommand Insight, Snap Creator Framework), and multiple Oracle enterprise applications.

How do I fix CVE-2016-8735?

Upgrade Apache Tomcat to version 6.0.48, 7.0.73, 8.0.39, 8.5.7, or 9.0.0.M12 or later depending on your version branch. As an immediate mitigation, disable the JmxRemoteLifecycleListener if not required, and block external access to JMX ports via firewall rules. Apply downstream vendor patches for your specific platform. See the Remediation section for comprehensive steps.

How severe is CVE-2016-8735?

CVE-2016-8735 carries a CVSS v3.1 base score of 9.8 (Critical), the highest severity rating. It allows unauthenticated remote code execution with complete impact on confidentiality, integrity, and availability. The EPSS percentile of 99.8% places it among the most dangerous known vulnerabilities. This vulnerability is directly related to CVE-2016-3427 and both should be patched together for complete protection.

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score90.34%
EPSS Percentile99.8%

Dates

PublishedApril 6, 2017
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch