CVE-2016-8735β€”Apache Tomcat Remote Code Execution Vulnerability

PUBLISHEDvulnerability record
2023-05-12 Β· last modified June 21, 2025

Metadata

CVE ID:
CVE-2016-8735
Project:
Apache
Product:
Tomcat
Date Added:
2023-05-12
Due Date:
2023-06-02
Last Updated:
June 21, 2025

Vulnerability Name

Apache Tomcat Remote Code Execution Vulnerability

Description

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:
Unknown

Action

Apply updates per vendor instructions.

Additional Notes

  • https://tomcat.apache.org/security-9.html
  • https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Related Weaknesses

browse all CVEs