CVE-2016-8735 Apache Tomcat Remote Code Execution
Remote attackers can execute arbitrary code on Apache Tomcat servers if the JmxRemoteLifecycleListener is enabled and JMX ports are accessible.
- Exploited in the wild
- Since 12 May 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8735?
CVE-2016-8735 is a critical unsafe deserialization vulnerability in Apache Tomcat, published on 6 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Which versions are affected by CVE-2016-8735?
20 open source packages ship an affected version, including org.apache.tomcat:tomcat-catalina and org.apache.tomcat:tomcat-catalina-jmx-remote. It affects 19 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat-catalina Maven | All versions | 6.0.48 |
org.apache.tomcat:tomcat-catalina Maven | All versions | 6.0.48 |
org.apache.tomcat:tomcat-catalina Maven | From 7.0.0 | 7.0.73 |
org.apache.tomcat:tomcat-catalina Maven | From 7.0.0 | 7.0.73 |
org.apache.tomcat:tomcat-catalina Maven | From 8.0.0 | 8.0.39 |
org.apache.tomcat:tomcat-catalina Maven | From 8.0.0 | 8.0.39 |
14 more packages
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 | 8.5.7 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 | 8.5.7 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0.M1 | 9.0.0.M12 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0.M1 | 9.0.0.M12 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | All versions | 6.0.48 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | All versions | 6.0.48 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | From 7.0.0 | 7.0.73 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | From 7.0.0 | 7.0.73 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | From 8.0.0 | 8.0.39 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | From 8.0.0 | 8.0.39 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | From 8.5.0 | 8.5.7 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | From 8.5.0 | 8.5.7 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | From 9.0.0.M1 | 9.0.0.M12 |
org.apache.tomcat:tomcat-catalina-jmx-remote Maven | From 9.0.0.M1 | 9.0.0.M12 |
Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Netapp 7-Mode Transition Tool, Netapp Oncommand Insight, Netapp Oncommand Shift and 13 more.
How do I fix CVE-2016-8735?
Upgrade org.apache.tomcat:tomcat-catalina to a fixed version for your release line: 6.0.48, 7.0.73, 8.0.39 or 8.5.7. US federal agencies must fix it by 2 Jun 2023.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2016-8735 being exploited?
Yes. Attackers have exploited CVE-2016-8735 in the wild since at least 12 May 2023.
Other vulnerabilities in Apache Tomcat
- CVE-2025-24813 Apache Tomcat Path Equivalence
- CVE-2017-12617 Apache Tomcat Remote Code Execution
- CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution
- CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data
- CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
Sources
Also known as GHSA-cw54-59pw-4g8c, UBUNTU-CVE-2016-8735, USN-7242-1.