{"id":"CVE-2016-8735","kind":"vulnerability","aliases":["CVE-2016-8735"],"related":[],"title":"Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x…","description":"Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Apache Tomcat's JmxRemoteLifecycleListener can be abused for remote code execution when an attacker can reach the JMX port. CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-05-12T00:00:00+00:00","products":[{"name":"apache tomcat","fixed":["6.0.48"],"affected":"< 6.0.48","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["7.0.73"],"affected":">= 7.0.0, < 7.0.73","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["8.0.39"],"affected":">= 8.0, < 8.0.39","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["8.5.7"],"affected":">= 8.5.0, < 8.5.7","ecosystem":"vendor"},{"name":"apache tomcat","fixed":[],"affected":"= 9.0.0","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 16.04","ecosystem":"vendor"},{"name":"netapp 7-mode transition tool","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp oncommand insight","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp oncommand shift","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp snap creator framework","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat jboss enterprise web server","fixed":[],"affected":"= 3.0.0","ecosystem":"vendor"},{"name":"oracle agile engineering data management","fixed":[],"affected":"= 6.1.3","ecosystem":"vendor"},{"name":"oracle agile engineering data management","fixed":[],"affected":"= 6.2.0","ecosystem":"vendor"},{"name":"oracle agile engineering data management","fixed":[],"affected":"= 6.2.1.0","ecosystem":"vendor"},{"name":"oracle agile product lifecycle management","fixed":[],"affected":"= 9.3.5","ecosystem":"vendor"},{"name":"oracle agile product lifecycle management","fixed":[],"affected":"= 9.3.6","ecosystem":"vendor"},{"name":"oracle communications application session controller","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"oracle communications application session controller","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"oracle communications instant messaging server","fixed":[],"affected":"= 10.0.1","ecosystem":"vendor"},{"name":"oracle communications interactive session recorder","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"oracle communications interactive session recorder","fixed":[],"affected":"= 6.1","ecosystem":"vendor"},{"name":"oracle communications interactive session recorder","fixed":[],"affected":"= 6.2","ecosystem":"vendor"},{"name":"oracle hospitality guest access","fixed":[],"affected":"= 4.2.0","ecosystem":"vendor"},{"name":"oracle hospitality guest access","fixed":[],"affected":"= 4.2.1","ecosystem":"vendor"},{"name":"oracle micros relate crm software","fixed":[],"affected":"= 10.8","ecosystem":"vendor"},{"name":"oracle micros relate crm software","fixed":[],"affected":"= 11.4","ecosystem":"vendor"},{"name":"oracle micros retail xbri loss prevention","fixed":[],"affected":"= 10.0.1","ecosystem":"vendor"},{"name":"oracle micros retail xbri loss prevention","fixed":[],"affected":"= 10.5.0","ecosystem":"vendor"},{"name":"oracle micros retail xbri loss prevention","fixed":[],"affected":"= 10.6.0","ecosystem":"vendor"},{"name":"oracle micros retail xbri loss prevention","fixed":[],"affected":"= 10.7.7","ecosystem":"vendor"},{"name":"oracle micros retail xbri loss prevention","fixed":[],"affected":"= 10.8.0","ecosystem":"vendor"},{"name":"oracle micros retail xbri loss prevention","fixed":[],"affected":"= 10.8.1","ecosystem":"vendor"},{"name":"oracle mysql enterprise monitor","fixed":[],"affected":"<= 3.2.8.2223","ecosystem":"vendor"},{"name":"oracle mysql enterprise monitor","fixed":[],"affected":">= 3.3.0, <= 3.3.4.3247","ecosystem":"vendor"},{"name":"oracle mysql enterprise monitor","fixed":[],"affected":">= 3.4.0, <= 3.4.2.4181","ecosystem":"vendor"},{"name":"oracle retail convenience and fuel pos software","fixed":[],"affected":"= 2.1.132","ecosystem":"vendor"},{"name":"oracle transportation management","fixed":[],"affected":"= 6.3.0","ecosystem":"vendor"},{"name":"oracle transportation management","fixed":[],"affected":"= 6.3.1","ecosystem":"vendor"},{"name":"oracle transportation management","fixed":[],"affected":"= 6.3.2","ecosystem":"vendor"},{"name":"Apache Tomcat","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","runtime","self-hosted","tomcat"],"not_affected_if":["jmx-ports-firewalled","no-jmx-listener","tomcat-not-used"],"how_to_check":"Look for JmxRemoteLifecycleListener in conf/server.xml or any loaded configuration.\nCheck whether JMX remote ports are reachable from untrusted networks.","fix":"Upgrade Apache Tomcat to a release that includes the fix for CVE-2016-8735 (version unknown from sources).\nApply the vendor updates per CISA guidance, or remove JmxRemoteLifecycleListener and firewall JMX ports.","status":"open","published_at":"2017-04-06T21:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:49+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:06:49Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Tomcat to a release that includes the fix for CVE-2016-8735 (version unknown from sources).\nApply the vendor updates per CISA guidance, or remove JmxRemoteLifecycleListener and firewall JMX ports.","reach":"network","impact":"high","summary":"Apache Tomcat's JmxRemoteLifecycleListener can be abused for remote code execution when an attacker can reach the JMX port. CISA lists it as actively exploited.","category":"runtime","who_cares":["tomcat","java","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the Tomcat server via exposed JMX.","analyst_note":"Sources do not list affected or fixed Tomcat versions; check the Apache Tomcat security pages for CVE-2016-8735 and the affected version ranges.","how_to_check":"Look for JmxRemoteLifecycleListener in conf/server.xml or any loaded configuration.\nCheck whether JMX remote ports are reachable from untrusted networks.\nunknown","needs_analyst":true,"not_affected_if":["no-jmx-listener","jmx-ports-firewalled","tomcat-not-used"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000519,"input_tokens":2855,"output_tokens":468,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':22A,25A,277C '-3427':278C '-8735':23A,26A '6.0.48':10A '7':11A,41A '7.0.73':14A '8':15A '8.0.39':18A '8.5':19A 'abus':214B 'access':120A,124A 'action':285C 'activ':231B 'affect':280C 'agile':63A,68A,73A,78A,83A 'allow':240C 'and':186A 'apach':7A,208B,233C 'apache':27A,29A,31A,33A,35A,199A 'appli':286C 'application':89A,94A 'attack':221B,251C 'canonical':37A 'cisa':227B,283C 'code':2A,217B,243C 'communications':88A,93A,98A,103A,108A,113A 'consist':269C 'contain':235C 'controller':91A,96A 'convenience':185A 'creator':53A 'credenti':281C 'crm':128A,133A 'cve':21A,24A,260C,276C 'data':65A,70A,75A 'debian':55A 'engineering':64A,69A,74A 'enterprise':59A,173A,177A,181A 'execut':3A,218B,244C 'exist':261C 'exploit':201B,232B 'extens':256C 'framework':54A 'fuel':187A 'guest':119A,123A 'hospitality':118A,122A 'host':206B 'insight':47A 'instant':99A 'instruct':290C 'interactive':104A,109A,114A 'issu':274C 'java':202B,254C 'jboss':58A 'jmx':225B,257C 'jmxremotelifecyclelisten':211B,246C 'lifecycle':80A,85A 'linux':39A,56A 'list':228B 'listen':264C 'loss':139A,145A,151A,157A,163A,169A 'manag':255C 'management':66A,71A,76A,81A,86A,192A,195A,198A 'messaging':100A 'micros':126A,131A,136A,142A,148A,154A,160A,166A 'mode':42A 'monitor':174A,178A,182A 'mysql':172A,176A,180A 'netapp':40A,45A,48A,51A 'oncommand':46A,49A 'oracl':272C 'oracle':62A,67A,72A,77A,82A,87A,92A,97A,102A,107A,112A,117A,121A,125A,130A,135A,141A,147A,153A,159A,165A,171A,175A,179A,183A,190A,193A,196A 'patch':273C 'per':288C 'port':226B,258C 'pos':188A 'possibl':5A 'prevention':140A,146A,152A,158A,164A,170A 'product':79A,84A 'reach':223B,253C 'recorder':106A,111A,116A 'redhat':57A 'relate':127A,132A 'remot':1A,216B,242C 'requir':284C 'retail':137A,143A,149A,155A,161A,167A,184A 'runtim':203B 'self':205B 'self-host':204B 'server':61A,101A 'session':90A,95A,105A,110A,115A 'shift':50A 'snap':52A 'software':129A,134A,189A 'tomcat':8A,28A,30A,32A,34A,36A,200A,207B,209B,234C 'tool':44A 'transition':43A 'transportation':191A,194A,197A 'type':282C 'ubuntu':38A 'unspecifi':237C 'updat':267C,287C 'use':248C 'vendor':289C 'vulner':238C 'wasn':265C 'web':60A 'x':12A,16A,20A 'xbri':138A,144A,150A,156A,162A,168A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-04-06T21:59:00+00:00","kev":{"dateAdded":"2023-05-12","dueDate":"2023-06-02","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-8735","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-8735","severity":null,"published_at":"2023-05-12T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-8735","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8735","severity":null,"published_at":"2017-04-06T21:59:00+00:00","modified_at":"2026-08-25T16:28:27+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}