CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

CVE-2016-8735 is a remote code execution vulnerability in Apache Tomcat. It can be abused when the JmxRemoteLifecycleListener is in use and an attacker can reach the Java Management Extension (JMX) ports. Successful exploitation lets an attacker run code on the server, which can lead to full host compromise, data theft, or further lateral movement inside the environment. Defenders should treat any Tomcat instance exposing JMX with this listener as high priority until the vendor update is confirmed and applied.

How it works

The weakness is classified as CWE-284 (Improper Access Control). According to the CISA summary, Apache Tomcat contains an unspecified vulnerability that allows remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach the JMX ports. The issue exists because this listener was not updated for consistency with the Oracle-patched issues for CVE-2016-3427, which affected credential types. In practice, an attacker who can connect to the exposed JMX interface may bypass intended authentication or authorization controls and achieve code execution on the Tomcat process. Exact exploit mechanics and any required conditions beyond reachability of the JMX ports must be confirmed against the vendor advisory; no public exploit details are provided here.

Am I affected? How to find it in your systems

Apache Tomcat is commonly deployed as a servlet container for Java web applications, often on Linux or Windows servers in development, staging, and production environments. It may run as a standalone service, inside containers, or embedded in larger application stacks. Inventory every Tomcat installation by searching package managers, process lists, service definitions, and configuration directories for catalina.base or catalina.home paths. Check whether JmxRemoteLifecycleListener appears in server.xml or related configuration files and whether JMX ports (commonly RMI-related) are listening and reachable from untrusted networks. Compare the installed Tomcat version and configuration against the vendor advisory for this CVE; do not rely on version numbers not listed in that advisory. Review network flow logs, firewall logs, and Tomcat access or catalina logs for unexpected connections to JMX ports or unusual remote management activity. Telemetry showing successful authentication or object invocation against JMX from external sources should be treated as a potential indicator of exploitation attempts.

How to remediate

Apply the vendor-supplied updates for Apache Tomcat as instructed in the official advisory. CISA requires that organizations apply updates per vendor instructions. After patching, verify that the JmxRemoteLifecycleListener configuration no longer exposes the vulnerable behavior and that JMX ports are no longer reachable without proper controls. For this class of improper-access-control issues, also review and harden any remaining remote management interfaces: disable unused listeners, enforce strong authentication where JMX must remain enabled, and restrict network access to management ports. Re-scan the environment after remediation to confirm the listener and ports are no longer in the vulnerable state.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls. Segment Tomcat hosts so that JMX ports are reachable only from trusted management networks or jump hosts. Use host-based or network firewalls to block inbound connections to JMX ports from untrusted sources. If a web application firewall or virtual-patching capability is available, apply rules that restrict or monitor traffic patterns associated with JMX remote access. Disable the JmxRemoteLifecycleListener entirely if remote JMX management is not required for operations. Increase monitoring and alerting on any remaining JMX traffic, process creation from the Tomcat user, and anomalous outbound connections. These steps lower risk but do not replace the official patch.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities can lead to breaches in which attackers steal credentials, application data, or other sensitive information. Known ransomware use of this CVE is not documented. If you suspect compromise, isolate the host, preserve logs, and follow your incident-response process. Separately, you can run a free exposure scan of your email address to check whether it appears in known breach data sets.