Apache Tomcat Remote Code Execution Vulnerability (CVE-2016-8735)
Severity: critical · Patch status: patched · Since 2023-05-12 · CVE-2016-8735
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types. CISA added CVE-2016-8735 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.
What to do
- Apply updates per vendor instructions.
- US federal agencies must remediate by Jun 2, 2023 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch