CVE Watch—

CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

CVSS

—

No CVSS

EPSS

100.0%

p100

KEV

YES

Mar 25, 2022

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

100.0%EPSS · 30 days100.0%

2026-06-302026-07-16

KEV catalog record

Product

Apache / Tomcat

Vulnerability

Apache Tomcat Remote Code Execution Vulnerability

Added to KEV

Mar 25, 2022

Remediate by

Apr 15, 2022

Known ransomware use

Summary description

When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2017-12617

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-24813—

100.0%

KEV—80Apache Tomcat Path Equivalence Vulnerability—CVE-2020-1938—

99.9%

KEV—80Apache Tomcat Improper Privilege Management Vulnerability—CVE-2017-12615—

99.9%

KEV—80Apache Tomcat on Windows Remote Code Execution Vulnerability—CVE-2016-8735—

99.8%

KEV—80Apache Tomcat Remote Code Execution Vulnerability—