← Vulnerability Intelligence

CVE-2016-8735

Critical 9.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Apache Tomcat Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
90% (percentile: 100) as of 1 November 2026

Affected products

apache: tomcat; canonical: ubuntu linux; netapp: 7-mode transition tool; netapp: oncommand insight; netapp: oncommand shift; netapp: snap creator framework; debian: debian linux; redhat: jboss enterprise web server; oracle: agile engineering data management; oracle: agile product lifecycle management; oracle: communications application session controller; oracle: communications instant messaging server; oracle: communications interactive session recorder; oracle: hospitality guest access; oracle: micros relate crm software

References