CVE Watch—

CVE-2017-12615

Apache Tomcat on Windows Remote Code Execution Vulnerability

CVSS

—

No CVSS

EPSS

99.6%

p100

KEV

YES

Mar 25, 2022

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

99.6%EPSS · 30 days99.6%

2026-06-302026-07-16

KEV catalog record

Product

Apache / Tomcat

Vulnerability

Apache Tomcat on Windows Remote Code Execution Vulnerability

Added to KEV

Mar 25, 2022

Remediate by

Apr 15, 2022

Known ransomware use

Yes

Summary description

When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2017-12615

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2017-12617—

100.0%

KEV—80Apache Tomcat Remote Code Execution Vulnerability—CVE-2025-24813—

100.0%

KEV—80Apache Tomcat Path Equivalence Vulnerability—CVE-2020-1938—

99.9%

KEV—80Apache Tomcat Improper Privilege Management Vulnerability—CVE-2016-8735—

99.8%

KEV—80Apache Tomcat Remote Code Execution Vulnerability—