Intel

CVE-2016-8735

The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types. (CVE-2016-8735)

criticalKEV: actively exploitedPoCEPSS 90%

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Source: CVELISTV5CISA_KEVNVDCVEORGOSV

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-8735 carries a CVSS v3 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and sits at the 99.8th EPSS percentile, meaning virtually every other CVE in the dataset has a lower probability of exploitation. The vulnerability enables unauthenticated remote code execution via exposed JMX ports — a configuration that is surprisingly common in CI/CD pipelines, legacy application servers, and OT-adjacent middleware where JMX was enabled for monitoring and never locked down. CISA's addition to the KEV list in May 2023 — years after the original 2016 disclosure — confirms that unpatched Tomcat instances continue to be targeted opportunistically. Organisations running any of the affected version ranges with JMX reachable from untrusted networks should treat this as a P1 incident and prioritise patching and port blocking above all other remediation work in the current sprint.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch now: Upgrade Apache Tomcat to 6.0.48+, 7.0.73+, 8.0.39+, 8.5.7+, or 9.0.0.M12+ as documented in the Apache Tomcat security advisory for CVE-2016-8735. Packages are available from the official Apache Tomcat download page.
  • Block JMX ports at the firewall immediately: Drop inbound traffic to the JMX RMI registry port (default 1099/TCP) and any configured RMI server ports from untrusted network segments — do this before the patch window opens.
  • Disable JmxRemoteLifecycleListener: Comment out or remove the org.apache.catalina.mbeans.JmxRemoteLifecycleListener entry in server.xml on every instance where remote JMX access is not operationally required.
  • Inventory all Tomcat instances: Cross-reference your CMDB with an active scan (Nmap targeting 8080/TCP, 8443/TCP, 1099/TCP) to identify every running Tomcat instance — pay particular attention to DMZ hosts, CI/CD build agents, and OT-adjacent middleware.
  • Inspect active JMX connections: Run ss -tnp | grep 1099 (Linux) or netstat -ano | findstr 1099 (Windows) on each Tomcat host; any connection from an unexpected source IP warrants immediate isolation and forensic preservation.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Restrict JMX ports to a dedicated management VLAN; no direct reachability from the internet or user VLANs. Firewall ACL: deny tcp any !mgmt-vlan eq 1099.
  • Disable remote codebase loading: Add -Dcom.sun.jndi.rmi.object.trustURLCodebase=false and -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false to CATALINA_OPTS. Java 8u121+ sets these by default; older JREs must be configured explicitly to close the JNDI/RMI remote-codebase attack path.
  • IPS signature: Enable Suricata/Snort rules for anomalous Java RMI handshakes on 1099/TCP; the emerging-exploit.rules ruleset contains Java RMI exploit signatures that serve as a reasonable approximation until a CVE-specific SID is available.
  • Least-privilege process account: Run the Tomcat service under a dedicated, non-privileged OS account with no interactive shell, no sudo rights, and no write access to system directories.
  • WAF rule: Alert or block HTTP requests with Content-Type: application/x-java-serialized-object headers or anomalously large POST bodies directed at Tomcat endpoints.
  • Verify JRE version: Confirm the underlying JRE/JDK is at least 8u121, where Oracle patched the root RMI credential issue (CVE-2016-3427). Running a vulnerable JRE compounds the risk significantly.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): Alert on any connection to port 1099/TCP or configured RMI server ports originating from IPs outside the management whitelist. Zeek filter: conn.log | where id.resp_p == 1099 && !id.orig_h in mgmt_whitelist.
  • Process ancestry (EDR/Sysmon EID 1): Flag child processes of java / java.exe that are shells or download utilities — cmd.exe, sh, bash, curl, wget spawned by the Tomcat process. KQL approximation: ProcessCreationEvents | where ParentProcessName has "java" and FileName in ("cmd.exe","sh","bash","curl","wget").
  • Tomcat access log: Unusual POST requests to /manager/, /host-manager/, or serialization endpoints returning HTTP 200 after prior 401/403 responses — a pattern consistent with authentication bypass followed by successful exploitation.
  • Linux auditd: Monitor execve syscalls by the Tomcat service account for unexpected binaries: auditctl -a always,exit -F arch=b64 -S execve -F uid=tomcat -k tomcat_exec.
  • Windows Event Log (EID 4688 / Sysmon EID 1): Process creation events under the Tomcat service account for interpreters (powershell.exe, cmd.exe) or network reconnaissance tools as post-exploitation indicators.

Metrics

Severity
critical
Priority score
208.87
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
90.3 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2017-04-06 21:00 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CPE Deprecation Remap2026-08-25 16:28 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:* → OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*
  2. CPE Deprecation Remap2026-08-25 16:28 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:* → OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*

Affected operating systems

  • linux

    debian / debian_linux8.0

  • linux

    canonical / ubuntu_linux16.04

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apache

    tomcat7.0.0 – 7.0.73

  • apache

    tomcat8.0 – 8.0.39

  • apache

    tomcat8.5.0 – 8.5.7

  • apache

    tomcat6.0.48

  • apache

    tomcat

  • netapp

    7-mode_transition_tool

  • netapp

    oncommand_insight

  • netapp

    oncommand_shift

  • netapp

    snap_creator_framework

  • oracle

    agile_engineering_data_management

  • oracle

    agile_product_lifecycle_management

  • oracle

    communications_application_session_controller

  • oracle

    communications_instant_messaging_server

  • oracle

    communications_interactive_session_recorder

  • oracle

    hospitality_guest_access

  • oracle

    micros_relate_crm_software

  • oracle

    micros_retail_xbri_loss_prevention

  • oracle

    mysql_enterprise_monitor3.3.0 – 3.3.4.3247

  • oracle

    mysql_enterprise_monitor3.4.0 – 3.4.2.4181

  • oracle

    mysql_enterprise_monitor3.2.8.2223

  • oracle

    retail_convenience_and_fuel_pos_software

  • oracle

    transportation_management

  • redhat

    jboss_enterprise_web_server

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-8735