CVE-2016-6796 Apache Tomcat vulnerable to SecurityManager bypass

What is CVE-2016-6796?

CVE-2016-6796 is a high-severity vulnerability in Apache Tomcat, published on 11 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

Which versions are affected by CVE-2016-6796?

10 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 15 products.

Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Netapp Oncommand Insight, Netapp Oncommand Shift, Netapp Snap Creator Framework and 9 more.

How do I fix CVE-2016-6796?

Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 6.0.46, 7.0.71, 8.0.37 or 8.5.5.

Is CVE-2016-6796 being exploited?

There is no known exploitation of CVE-2016-6796 in the wild and no public exploit code.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3mjp-p938-4329, UBUNTU-CVE-2016-6796.