CVE Watch25 ago 2026

CVE-2016-8735

Apache Tomcat Remote Code Execution Vulnerability

CVSS

9.8

Crítico

EPSS

90.3%

p100

KEV

SÍ

12 may 2023

Exploit Today

0-100

Publicado: 6 abr 2017 · Última mod.: 25 ago 2026

EPSS · 30d

90.3%EPSS · 30 días90.3%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Apache / Tomcat

Vulnerabilidad

Apache Tomcat Remote Code Execution Vulnerability

Añadido a KEV

12 may 2023

Remediar antes de

2 jun 2023

Uso conocido en ransomware

Descripción resumida

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Acción requerida

Apply updates per vendor instructions.

Notas

https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Descripción técnica

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-344867.5 ALT

93.7%

KEV—78Apache Tomcat Missing Encryption of Sensitive Data Vulnerability23d CVE-2020-19389.8 CRÍ

99.9%

KEV—80Apache Tomcat Improper Privilege Management Vulnerability51d CVE-2017-126178.1 ALT

100.0%

KEV—80Apache Tomcat Remote Code Execution Vulnerability51d CVE-2017-126158.1 ALT

100.0%

KEV—80Apache Tomcat on Windows Remote Code Execution Vulnerability70d CVE-2025-24813—

100.0%

KEV—80Apache Tomcat Path Equivalence Vulnerability—