---
id: "CVE-2016-4437"
kind: "vulnerability"
aliases: ["CVE-2016-4437"]
title: "Apache Shiro: Apache Shiro Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.93039
exploited: true
status: "open"
category: "package"
products: [{"name": "Apache Shiro", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-shiro", "exploited", "java", "package", "spring"]
not_affected_if: ["cipher-key-configured", "remember-me-disabled"]
published_at: "2016-06-07T14:06:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-4437", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4437", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4437", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apache Shiro: Apache Shiro Code Execution Vulnerability

Apache Shiro, a Java security and access-control library, has a flaw where a crafted request parameter can run code or bypass access checks when the "remember me" feature has no cipher key configured. Attackers can gain code execution on the server without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Shiro affected ? fixed ?

## How to check

Search application config and code for the "remember me" setting (rememberMeManager / cipherKey) and confirm a cipher key is set; check the Shiro version in dependencies (pom.xml, build.gradle, or lockfile).

## Fix

Upgrade Apache Shiro to a fixed release per the vendor advisory (fixed version unknown from sources), and set an explicit, strong rememberMe cipher key.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-4437
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-4437
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-4437

## From the sources

Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_