CVE-2016-8735

Act now ● On CISA KEV — actively exploited

Actively exploited — on the CISA KEV list.

CVSS base

9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — probability of exploitation (30 days)

90.3%

99.8th percentile

CISA KEV

Listed

Added 2023-05-12 · patch by 2023-06-02

Weakness / dates

—

Published 2017-04-06 · modified 2026-08-25

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	H	High
Availability	H	High

Timeline

2017-04-06 — Published (NVD)
2023-05-12 — Added to CISA KEV (actively exploited)
2023-06-02 — CISA patch-by deadline
2026-08-25 — Last modified (NVD)

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Affected

apache canonical debian netapp oracle redhat

References

Official: NVD · CVE.org