---
id: "CVE-2016-8735"
kind: "vulnerability"
aliases: ["CVE-2016-8735"]
title: "Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "apache tomcat", "fixed": ["6.0.48"], "affected": "< 6.0.48", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["7.0.73"], "affected": ">= 7.0.0, < 7.0.73", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["8.0.39"], "affected": ">= 8.0, < 8.0.39", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["8.5.7"], "affected": ">= 8.5.0, < 8.5.7", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": "= 9.0.0", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 16.04", "ecosystem": "vendor"}, {"name": "netapp 7-mode transition tool", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand insight", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand shift", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp snap creator framework", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat jboss enterprise web server", "fixed": [], "affected": "= 3.0.0", "ecosystem": "vendor"}, {"name": "oracle agile engineering data management", "fixed": [], "affected": "= 6.1.3", "ecosystem": "vendor"}, {"name": "oracle agile engineering data management", "fixed": [], "affected": "= 6.2.0", "ecosystem": "vendor"}, {"name": "oracle agile engineering data management", "fixed": [], "affected": "= 6.2.1.0", "ecosystem": "vendor"}, {"name": "oracle agile product lifecycle management", "fixed": [], "affected": "= 9.3.5", "ecosystem": "vendor"}, {"name": "oracle agile product lifecycle management", "fixed": [], "affected": "= 9.3.6", "ecosystem": "vendor"}, {"name": "oracle communications application session controller", "fixed": [], "affected": "= 3.7.1", "ecosystem": "vendor"}, {"name": "oracle communications application session controller", "fixed": [], "affected": "= 3.8.0", "ecosystem": "vendor"}, {"name": "oracle communications instant messaging server", "fixed": [], "affected": "= 10.0.1", "ecosystem": "vendor"}, {"name": "oracle communications interactive session recorder", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "oracle communications interactive session recorder", "fixed": [], "affected": "= 6.1", "ecosystem": "vendor"}, {"name": "oracle communications interactive session recorder", "fixed": [], "affected": "= 6.2", "ecosystem": "vendor"}, {"name": "oracle hospitality guest access", "fixed": [], "affected": "= 4.2.0", "ecosystem": "vendor"}, {"name": "oracle hospitality guest access", "fixed": [], "affected": "= 4.2.1", "ecosystem": "vendor"}, {"name": "oracle micros relate crm software", "fixed": [], "affected": "= 10.8", "ecosystem": "vendor"}, {"name": "oracle micros relate crm software", "fixed": [], "affected": "= 11.4", "ecosystem": "vendor"}, {"name": "oracle micros retail xbri loss prevention", "fixed": [], "affected": "= 10.0.1", "ecosystem": "vendor"}, {"name": "oracle micros retail xbri loss prevention", "fixed": [], "affected": "= 10.5.0", "ecosystem": "vendor"}, {"name": "oracle micros retail xbri loss prevention", "fixed": [], "affected": "= 10.6.0", "ecosystem": "vendor"}, {"name": "oracle micros retail xbri loss prevention", "fixed": [], "affected": "= 10.7.7", "ecosystem": "vendor"}, {"name": "oracle micros retail xbri loss prevention", "fixed": [], "affected": "= 10.8.0", "ecosystem": "vendor"}, {"name": "oracle micros retail xbri loss prevention", "fixed": [], "affected": "= 10.8.1", "ecosystem": "vendor"}, {"name": "oracle mysql enterprise monitor", "fixed": [], "affected": "<= 3.2.8.2223", "ecosystem": "vendor"}, {"name": "oracle mysql enterprise monitor", "fixed": [], "affected": ">= 3.3.0, <= 3.3.4.3247", "ecosystem": "vendor"}, {"name": "oracle mysql enterprise monitor", "fixed": [], "affected": ">= 3.4.0, <= 3.4.2.4181", "ecosystem": "vendor"}, {"name": "oracle retail convenience and fuel pos software", "fixed": [], "affected": "= 2.1.132", "ecosystem": "vendor"}, {"name": "oracle transportation management", "fixed": [], "affected": "= 6.3.0", "ecosystem": "vendor"}, {"name": "oracle transportation management", "fixed": [], "affected": "= 6.3.1", "ecosystem": "vendor"}, {"name": "oracle transportation management", "fixed": [], "affected": "= 6.3.2", "ecosystem": "vendor"}, {"name": "Apache Tomcat", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "runtime", "self-hosted", "tomcat"]
not_affected_if: ["jmx-ports-firewalled", "no-jmx-listener", "tomcat-not-used"]
published_at: "2017-04-06T21:59:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-8735", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8735", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x…

Apache Tomcat's JmxRemoteLifecycleListener can be abused for remote code execution when an attacker can reach the JMX port. CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apache tomcat affected < 6.0.48 fixed 6.0.48
- vendor:apache tomcat affected >= 7.0.0, < 7.0.73 fixed 7.0.73
- vendor:apache tomcat affected >= 8.0, < 8.0.39 fixed 8.0.39
- vendor:apache tomcat affected >= 8.5.0, < 8.5.7 fixed 8.5.7
- vendor:apache tomcat affected = 9.0.0 fixed ?
- vendor:canonical ubuntu linux affected = 16.04 fixed ?
- vendor:netapp 7-mode transition tool affected ? fixed ?
- vendor:netapp oncommand insight affected ? fixed ?
- vendor:netapp oncommand shift affected ? fixed ?
- vendor:netapp snap creator framework affected ? fixed ?
- vendor:debian linux affected = 8.0 fixed ?
- vendor:redhat jboss enterprise web server affected = 3.0.0 fixed ?
- vendor:oracle agile engineering data management affected = 6.1.3 fixed ?
- vendor:oracle agile engineering data management affected = 6.2.0 fixed ?
- vendor:oracle agile engineering data management affected = 6.2.1.0 fixed ?
- vendor:oracle agile product lifecycle management affected = 9.3.5 fixed ?
- vendor:oracle agile product lifecycle management affected = 9.3.6 fixed ?
- vendor:oracle communications application session controller affected = 3.7.1 fixed ?
- vendor:oracle communications application session controller affected = 3.8.0 fixed ?
- vendor:oracle communications instant messaging server affected = 10.0.1 fixed ?
- vendor:oracle communications interactive session recorder affected = 6.0 fixed ?
- vendor:oracle communications interactive session recorder affected = 6.1 fixed ?
- vendor:oracle communications interactive session recorder affected = 6.2 fixed ?
- vendor:oracle hospitality guest access affected = 4.2.0 fixed ?
- vendor:oracle hospitality guest access affected = 4.2.1 fixed ?
- vendor:oracle micros relate crm software affected = 10.8 fixed ?
- vendor:oracle micros relate crm software affected = 11.4 fixed ?
- vendor:oracle micros retail xbri loss prevention affected = 10.0.1 fixed ?
- vendor:oracle micros retail xbri loss prevention affected = 10.5.0 fixed ?
- vendor:oracle micros retail xbri loss prevention affected = 10.6.0 fixed ?
- vendor:oracle micros retail xbri loss prevention affected = 10.7.7 fixed ?
- vendor:oracle micros retail xbri loss prevention affected = 10.8.0 fixed ?
- vendor:oracle micros retail xbri loss prevention affected = 10.8.1 fixed ?
- vendor:oracle mysql enterprise monitor affected <= 3.2.8.2223 fixed ?
- vendor:oracle mysql enterprise monitor affected >= 3.3.0, <= 3.3.4.3247 fixed ?
- vendor:oracle mysql enterprise monitor affected >= 3.4.0, <= 3.4.2.4181 fixed ?
- vendor:oracle retail convenience and fuel pos software affected = 2.1.132 fixed ?
- vendor:oracle transportation management affected = 6.3.0 fixed ?
- vendor:oracle transportation management affected = 6.3.1 fixed ?
- vendor:oracle transportation management affected = 6.3.2 fixed ?
- vendor:Apache Tomcat affected ? fixed ?

## How to check

Look for JmxRemoteLifecycleListener in conf/server.xml or any loaded configuration.
Check whether JMX remote ports are reachable from untrusted networks.

## Fix

Upgrade Apache Tomcat to a release that includes the fix for CVE-2016-8735 (version unknown from sources).
Apply the vendor updates per CISA guidance, or remove JmxRemoteLifecycleListener and firewall JMX ports.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-8735
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-8735

## From the sources

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_