vulnerability
Ubuntu: (Multiple Advisories) (CVE-2016-8735): Tomcat vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Dec 10, 2016 | Jan 24, 2017 | Apr 16, 2026 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Dec 10, 2016
Added
Jan 24, 2017
Modified
Apr 16, 2026
Description
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Solutions
ubuntu-pro-upgrade-libservlet2-5-javaubuntu-upgrade-libservlet2-5-javaubuntu-upgrade-libtomcat6-javaubuntu-upgrade-libtomcat7-javaubuntu-upgrade-libtomcat8-javaubuntu-upgrade-tomcat6ubuntu-upgrade-tomcat7ubuntu-upgrade-tomcat8
References
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.