CVE-2016-8735

CVE-2016-8735 is a remote code execution flaw in Apache Tomcat's bundled JmxRemoteLifecycleListener, which was not updated for consistency with Oracle's patch for the related JMX issue CVE-2016-3427, leaving its credential handling insecure. The flaw can be triggered only when this listener is in use and an attacker can reach the server's JMX ports over the network; no authentication or user interaction is required (CVSS 9.8). Successful exploitation lets an attacker execute arbitrary code in the context of the Tomcat process. It affects Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, as well as Tomcat-containing products from Canonical, Debian, Red Hat, NetApp, and Oracle. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-05-12, indicating observed exploitation in the wild, and EPSS assigns a roughly 90% probability of exploitation within 30 days (99th percentile), although no public PoC is known.

What to do: Upgrade Tomcat to 6.0.48, 7.0.73, 8.0.39, 8.5.7, or 9.0.0.M12 or later, or apply vendor-patched packages/deliverables from Canonical, Debian, Red Hat, NetApp, or Oracle, per CISA's required action. Where upgrades are not immediate, remove or disable the JmxRemoteLifecycleListener or firewall the JMX ports so they are unreachable from untrusted networks. Inventory all Tomcat instances and Tomcat-embedding products (NetApp, Red Hat JBoss EWS, Oracle, distro packages) and confirm whether the JMX remote listener is enabled and exposed; ransomware use is unknown but KEV listing mandates patching by the required due date.