---
id: "CVE-2017-12615"
kind: "vulnerability"
aliases: ["CVE-2017-12615"]
title: "Apache Tomcat: Apache Tomcat on Windows Remote Code Execution Vulnerability"
severity: "high"
cvss: 8.1
epss: 0.99641
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Apache Tomcat", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ransomware", "runtime", "self-hosted", "tomcat", "windows"]
not_affected_if: ["linux-only-hosts", "put-disabled", "readonly-default-servlet"]
published_at: "2017-09-19T13:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12615", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-12615", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12615", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apache Tomcat: Apache Tomcat on Windows Remote Code Execution Vulnerability

Apache Tomcat on Windows with HTTP PUT enabled accepts a crafted PUT request that uploads a JSP file to the server. Requesting that JSP then runs whatever code it contains on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Tomcat affected ? fixed ?

## How to check

Confirm the host runs Tomcat on Windows and check conf/web.xml for the default servlet's readonly setting and whether readonly is set to false; a PUT to a test path returning 201 or 204 means exposure.

## Fix

Upgrade Apache Tomcat to a fixed release listed by Apache for CVE-2017-12615 (the sources do not list exact versions); set readonly to true on the default servlet or disable PUT.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12615
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-12615
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-12615

## From the sources

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_