CVE Watch25 de ago. de 2026

CVE-2016-8735

Apache Tomcat Remote Code Execution Vulnerability

CVSS

9.8

Crítica

EPSS

90.3%

p100

KEV

SIM

12 de mai. de 2023

Exploit Today

0-100

Publicado: 6 de abr. de 2017 · Última mod.: 25 de ago. de 2026

EPSS · 30d

90.3%EPSS · 30 dias90.3%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Apache / Tomcat

Vulnerabilidade

Apache Tomcat Remote Code Execution Vulnerability

Adicionado ao KEV

12 de mai. de 2023

Corrigir até

2 de jun. de 2023

Uso conhecido em ransomware

Não

Descrição resumida

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Ação necessária

Apply updates per vendor instructions.

Notas

https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Descrição técnica

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-344867.5 ALT

99.9%

KEV—80Apache Tomcat Missing Encryption of Sensitive Data Vulnerability10d CVE-2020-19389.8 CRÍ

99.9%

KEV—80Apache Tomcat Improper Privilege Management Vulnerability72d CVE-2017-126178.1 ALT

100.0%

KEV—80Apache Tomcat Remote Code Execution Vulnerability72d CVE-2017-126158.1 ALT

100.0%

KEV—80Apache Tomcat on Windows Remote Code Execution Vulnerability92d CVE-2025-24813—

100.0%

KEV—80Apache Tomcat Path Equivalence Vulnerability—