Live › vulnerability › CVE-2016-8735
Go to dashboardApache Tomcat's JmxRemoteLifecycleListener can be abused for remote code execution when an attacker can reach the JMX port. CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache tomcat | vendor | < 6.0.48 | 6.0.48 |
| apache tomcat | vendor | >= 7.0.0, < 7.0.73 | 7.0.73 |
| apache tomcat | vendor | >= 8.0, < 8.0.39 | 8.0.39 |
| apache tomcat | vendor | >= 8.5.0, < 8.5.7 | 8.5.7 |
| apache tomcat | vendor | = 9.0.0 | – |
| canonical ubuntu linux | vendor | = 16.04 | – |
| netapp 7-mode transition tool | vendor | – | – |
| netapp oncommand insight | vendor | – | – |
| netapp oncommand shift | vendor | – | – |
| netapp snap creator framework | vendor | – | – |
| debian linux | vendor | = 8.0 | – |
| redhat jboss enterprise web server | vendor | = 3.0.0 | – |
| oracle agile engineering data management | vendor | = 6.1.3 | – |
| oracle agile engineering data management | vendor | = 6.2.0 | – |
| oracle agile engineering data management | vendor | = 6.2.1.0 | – |
| oracle agile product lifecycle management | vendor | = 9.3.5 | – |
| oracle agile product lifecycle management | vendor | = 9.3.6 | – |
| oracle communications application session controller | vendor | = 3.7.1 | – |
| oracle communications application session controller | vendor | = 3.8.0 | – |
| oracle communications instant messaging server | vendor | = 10.0.1 | – |
| oracle communications interactive session recorder | vendor | = 6.0 | – |
| oracle communications interactive session recorder | vendor | = 6.1 | – |
| oracle communications interactive session recorder | vendor | = 6.2 | – |
| oracle hospitality guest access | vendor | = 4.2.0 | – |
| oracle hospitality guest access | vendor | = 4.2.1 | – |
| oracle micros relate crm software | vendor | = 10.8 | – |
| oracle micros relate crm software | vendor | = 11.4 | – |
| oracle micros retail xbri loss prevention | vendor | = 10.0.1 | – |
| oracle micros retail xbri loss prevention | vendor | = 10.5.0 | – |
| oracle micros retail xbri loss prevention | vendor | = 10.6.0 | – |
| oracle micros retail xbri loss prevention | vendor | = 10.7.7 | – |
| oracle micros retail xbri loss prevention | vendor | = 10.8.0 | – |
| oracle micros retail xbri loss prevention | vendor | = 10.8.1 | – |
| oracle mysql enterprise monitor | vendor | <= 3.2.8.2223 | – |
| oracle mysql enterprise monitor | vendor | >= 3.3.0, <= 3.3.4.3247 | – |
| oracle mysql enterprise monitor | vendor | >= 3.4.0, <= 3.4.2.4181 | – |
| oracle retail convenience and fuel pos software | vendor | = 2.1.132 | – |
| oracle transportation management | vendor | = 6.3.0 | – |
| oracle transportation management | vendor | = 6.3.1 | – |
| oracle transportation management | vendor | = 6.3.2 | – |
| Apache Tomcat | vendor | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2016-8735")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.