# CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

> CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability. CVSS 9.8 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2016-8735
Last updated: 2025-10-21T23:55:42Z

- Published: 2017-04-06 21:00 UTC · Updated: 2025-10-21 23:55 UTC · Assigner: apache
- CVSS: 9.8 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS: 90.3%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2023-05-12, federal due date 2023-06-02, ransomware use: Unknown

## Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

## CISA required action

Apply updates per vendor instructions.

## Affected vendors and products

- Apache Software Foundation: Apache Tomcat

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2016-8735)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2016-8735)
- [http://rhn.redhat.com/errata/RHSA-2017-0457.html](http://rhn.redhat.com/errata/RHSA-2017-0457.html)
- [https://access.redhat.com/errata/RHSA-2017:0455](https://access.redhat.com/errata/RHSA-2017:0455)
- [https://access.redhat.com/errata/RHSA-2017:0456](https://access.redhat.com/errata/RHSA-2017:0456)
- [http://seclists.org/oss-sec/2016/q4/502](http://seclists.org/oss-sec/2016/q4/502)
- [https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%2540%3Cdev.tomcat.apache.org%3E)
- [https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E](https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%2540%3Cdev.tomcat.apache.org%3E)
- [https://security.netapp.com/advisory/ntap-20180607-0001/](https://security.netapp.com/advisory/ntap-20180607-0001/)
- [https://usn.ubuntu.com/4557-1/](https://usn.ubuntu.com/4557-1/)
- [http://svn.apache.org/viewvc?view=revision&revision=1767644](http://svn.apache.org/viewvc?view=revision&revision=1767644)
- [http://svn.apache.org/viewvc?view=revision&revision=1767656](http://svn.apache.org/viewvc?view=revision&revision=1767656)
- [http://svn.apache.org/viewvc?view=revision&revision=1767676](http://svn.apache.org/viewvc?view=revision&revision=1767676)
- [http://svn.apache.org/viewvc?view=revision&revision=1767684](http://svn.apache.org/viewvc?view=revision&revision=1767684)
- [https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html](https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html)
- [https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html](https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html)
- [http://tomcat.apache.org/security-6.html](http://tomcat.apache.org/security-6.html)
- [http://tomcat.apache.org/security-7.html](http://tomcat.apache.org/security-7.html)
- [http://tomcat.apache.org/security-8.html](http://tomcat.apache.org/security-8.html)
- [http://tomcat.apache.org/security-9.html](http://tomcat.apache.org/security-9.html)
- [http://www.debian.org/security/2016/dsa-3738](http://www.debian.org/security/2016/dsa-3738)
- [http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html](http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html)
- [http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html](http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html)
- [http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html](http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html)
- [http://www.securityfocus.com/bid/94463](http://www.securityfocus.com/bid/94463)
- [http://www.securitytracker.com/id/1037331](http://www.securitytracker.com/id/1037331)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2016-8735 · Markdown: https://rewindex.com/cve/CVE-2016-8735.md · JSON: https://rewindex.com/api/v1/cves/CVE-2016-8735 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:01:46.295Z