CVE-2016-8735
Apache Tomcat Remote Code Execution Vulnerability
Published Apr 6, 2017 · updated Aug 25, 2026 · apache tomcat
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Timeline
Detection, updates, and resolution for this record.
Apr 6, 2017 · Catalog
Detected
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
May 12, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 2, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 25, 2026 · Catalog
Updated
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Required action
Apply updates per vendor instructions.
CISA due date Jun 2, 2023
Affected
- cpe apache/tomcatversion unspecified
- cpe apache/tomcat9.0.0
- cpe canonical/ubuntu linux16.04
- cpe debian/debian linux8.0
- cpe netapp/7-mode transition toolversion unspecified
- cpe redhat/jboss enterprise web server3.0.0
- vendor Apache Tomcatversion unspecified
Sources
- CISA KEVCVE-2016-8735
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
cisa.gov - CVE.orgCVE-2016-8735
Official CVE identifier
cve.org - FIRST EPSSCVE-2016-8735
30-day exploitation probability 90.3%
first.org - NIST NVDCVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated
nvd.nist.gov