Critical 9.8Known exploited (CISA KEV)Published Apr 6, 2017

CVE-2016-8735Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an att…

Updated under an hour ago (2026-10-19 05:50 UTC)

Does this affect you?

It affects Apache Software Foundation Apache Tomcat and 19 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since May 12, 2023; federal agencies had to remediate by Jun 2, 2023. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Tomcat

Exploited in the last 30 days

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Added to CISA KEV May 12, 2023; federal remediation due Jun 2, 2023Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 90.34% (percentile 100)
Assigned by: apache
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache Tomcat apache_software_foundation:apache_tomcat (from the name)	before 6.0.48; 7.x before 7.0.73; 8.x before 8.0.39; 8.5.x before 8.5.7; 9.x before 9.0.0.M12	CNA record
apache tomcat apache:tomcat	before 6.0.48; from 7.0.0 before 7.0.73; from 8.0 before 8.0.39; from 8.5.0 before 8.5.7; 9.0.0; 9.0.0; 9.0.0; 9.0.0; and 8 more ranges	NVD
canonical ubuntu_linux canonical:ubuntu_linux	16.04	NVD
netapp 7-mode_transition_tool netapp:7-mode_transition_tool	all versions	NVD
netapp oncommand_insight netapp:oncommand_insight	all versions	NVD
netapp oncommand_shift netapp:oncommand_shift	all versions	NVD
netapp snap_creator_framework netapp:snap_creator_framework	all versions	NVD
debian debian_linux debian:debian_linux	8.0	NVD
redhat jboss_enterprise_web_server redhat:jboss_enterprise_web_server	3.0.0	NVD
oracle agile_engineering_data_management oracle:agile_engineering_data_management	6.1.3; 6.2.0; 6.2.1.0	NVD
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management	9.3.5; 9.3.6	NVD
oracle communications_application_session_controller oracle:communications_application_session_controller	3.7.1; 3.8.0	NVD
oracle communications_instant_messaging_server oracle:communications_instant_messaging_server	10.0.1	NVD
oracle communications_interactive_session_recorder oracle:communications_interactive_session_recorder	6.0; 6.1; 6.2	NVD
oracle hospitality_guest_access oracle:hospitality_guest_access	4.2.0; 4.2.1	NVD
oracle micros_relate_crm_software oracle:micros_relate_crm_software	10.8; 11.4	NVD
oracle micros_retail_xbri_loss_prevention oracle:micros_retail_xbri_loss_prevention	10.0.1; 10.5.0; 10.6.0; 10.7.7; 10.8.0; 10.8.1	NVD
oracle mysql_enterprise_monitor oracle:mysql_enterprise_monitor	through 3.2.8.2223; from 3.3.0 through 3.3.4.3247; from 3.4.0 through 3.4.2.4181	NVD
oracle retail_convenience_and_fuel_pos_software oracle:retail_convenience_and_fuel_pos_software	2.1.132	NVD
oracle transportation_management oracle:transportation_management	6.3.0; 6.3.1; 6.3.2; 6.3.3; 6.3.4; 6.3.5; 6.3.6; 6.3.7	NVD

References

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlx-refsource-confirm, patch, third-party-advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlx-refsource-confirm, patch, third-party-advisory
http://svn.apache.org/viewvc?view=revision&revision=1767676x-refsource-confirm, broken-link, patch
http://tomcat.apache.org/security-9.htmlx-refsource-confirm, release-notes, vendor-advisory
http://www.securitytracker.com/id/1037331vdb-entry, x-refsource-sectrack, broken-link, third-party-advisory
http://www.securityfocus.com/bid/94463vdb-entry, x-refsource-bid, broken-link, third-party-advisory
http://www.debian.org/security/2016/dsa-3738vendor-advisory, x-refsource-debian, mailing-list, third-party-advisory
http://tomcat.apache.org/security-7.htmlx-refsource-confirm, release-notes, vendor-advisory
http://svn.apache.org/viewvc?view=revision&revision=1767644x-refsource-confirm, broken-link, patch
http://tomcat.apache.org/security-8.htmlx-refsource-confirm, release-notes, vendor-advisory
http://svn.apache.org/viewvc?view=revision&revision=1767656x-refsource-confirm, broken-link, patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlx-refsource-confirm, patch, third-party-advisory
https://security.netapp.com/advisory/ntap-20180607-0001/x-refsource-confirm
http://tomcat.apache.org/security-6.htmlx-refsource-confirm, release-notes, vendor-advisory
http://rhn.redhat.com/errata/RHSA-2017-0457.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
https://access.redhat.com/errata/RHSA-2017:0455vendor-advisory, x-refsource-redhat, third-party-advisory
http://svn.apache.org/viewvc?view=revision&revision=1767684x-refsource-confirm, broken-link, patch
https://access.redhat.com/errata/RHSA-2017:0456vendor-advisory, x-refsource-redhat, third-party-advisory
http://seclists.org/oss-sec/2016/q4/502x-refsource-confirm, mailing-list, mitigation, third-party-advisory
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist, patch
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist, patch
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist, patch
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Emailing-list, patch
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Emailing-list, patch
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3Emailing-list, patch
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Emailing-list, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.