Apache Tomcat on Windows Remote Code Execution Vulnerability (CVE-2017-12615)

What is affected, what to do

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Apache Tomcat eq 7.0.0 to 7.0.79..7.0.0 to 7.0.79

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory all Apache Tomcat instances on Windows (7.0.0 to 7.0.79). Upgrade immediately to 7.0.81 or later — 7.0.80 was withdrawn because its fix was incomplete.
   • If patching is not immediately possible, edit conf/web.xml, locate the DefaultServlet and ensure readonly is explicitly true (or remove the parameter, since true is the default). Restart Tomcat afterwards.
   • Block HTTP methods PUT, DELETE, OPTIONS, TRACE at the upstream reverse proxy (IIS, Apache httpd, nginx, load balancer); allow only GET, POST, HEAD.
   • Audit the webroot (webapps/) for unexpected .jsp, .jspx, .jsw, .jsv, .war files, especially recently modified ones or anything dropped into ROOT/. Preserve suspicious artefacts for forensics before removal.
   • Run the Tomcat process under a dedicated, non-privileged service account; if it currently runs as LocalSystem or Administrator, migrate it to a least-privilege account with minimal NTFS rights.
   • Rotate any credentials reachable from the Tomcat process context (DB connection strings in context.xml, keystore passwords, Kerberos service-account tickets).
2. 02

   Runbook step 2

   Mitigation layers

   • Network: isolate management and admin connectors (default 8005, 8009 AJP, 8443) into a dedicated management VLAN; expose Tomcat (8080/8443) to the internet only through a WAF or reverse proxy that enforces an HTTP-method allowlist.
   • WAF/IPS: enable signatures for PUT requests carrying JSP payloads (ET Open Snort/Suricata rules for CVE-2017-12615 and the related CVE-2017-12617, e.g. SID 2024613, 2024614). Also block URI tricks such as trailing slash, null byte, ::$DATA, trailing space (/foo.jsp/, /foo.jsp%20).
   • Filesystem hardening: set NTFS ACLs on webapps/ so the Tomcat service account cannot write .jsp files (read + execute only). Use a separate deployment user for updates.
   • Configuration baseline: enforce readonly=true on both DefaultServlet and the WebDAV servlet in web.xml; monitor configuration drift with Ansible, Puppet or Windows DSC.
   • Least privilege: apply an AppLocker or WDAC policy that prevents the Tomcat service from spawning cmd.exe, powershell.exe, cscript.exe, wscript.exe, certutil.exe or bitsadmin.exe as child processes.
   • Egress filtering: restrict outbound traffic from the Tomcat host to defined destinations (DB, internal services); block arbitrary HTTP/HTTPS/DNS to the internet to defeat second-stage downloads and C2.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs (Tomcat localhost_access_log, IIS, reverse proxy): alert on any PUT request whose path ends in .jsp, .jspx, .jsw, .jsv or includes a trailing /, %20 or ::$DATA. Example KQL: W3CIISLog | where csMethod == "PUT" and csUriStem matches regex @"(?i)\.jsp[xw]?(/|%20|::\$DATA)?$".
   • Sysmon EID 11 (File Create) for paths under webapps\**\*.jsp with a parent process of Tomcat*.exe — in normal operation JSP deployment is performed by CI/CD pipelines, not by the Tomcat process itself.
   • Sysmon EID 1 (Process Create) where ParentImage is tomcat*.exe or java.exe in the Tomcat context and Image is cmd.exe, powershell.exe, whoami.exe, net.exe, ipconfig.exe, certutil.exe — the classic post-exploitation chain of a JSP webshell.
   • Zeek/Suricata: HTTP transaction with method PUT to a Tomcat host, followed within 60 seconds by a GET to the same URI returning HTTP 200, especially with a short or scripted user-agent (curl, python-requests, empty).
   • Sigma shape: logsource: webserver / detection: selection: cs-method: PUT; cs-uri-stem|endswith: ['.jsp','.jspx']; condition: selection — safe as a baseline rule, since legitimate PUT-based JSP uploads practically never occur.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Source: OSV (Open Source Vulnerabilities), CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• NetApp NetApp 7-Mode Transition Tool
• NetApp Netapp Oncommand Balance
• NetApp Oncommand Shift
• Red Hat Redhat Enterprise Linux Desktop
• Red Hat Red Hat Enterprise Linux Extended Update Support (EUS)
• Red Hat Enterprise Linux Eus Compute Node
• Red Hat Red Hat Enterprise Linux For IBM Z Systems
• Red Hat Red Hat Enterprise Linux For IBM z Systems Extended Update Support (EUS) 7.1 s390x
• Red Hat Red Hat Enterprise Linux For Power, Big Endian
• Red Hat Red Hat Enterprise Linux For Power Big Endian Extended Update Support (EUS) 7.1 ppc64

References & sources

• NVD (NIST)vuln/detail/CVE-2017-12615advisory
• synology.comsupport/security/Synology_SA_17_54_Tomcatweb, x_refsource_CONFIRM
• exploit-db.comexploits/42953web
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12615web, government-resource
• security.netapp.comadvisory/ntap-20171018-0001web
• lists.apache.orgthread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cb…web
• lists.apache.org[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/web, Mailing list, x_refsource_MLIST
• lists.apache.orgthread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc…web
• lists.apache.org[announce] 20200131 Apache Software Foundation Security Report: 2019web, Mailing list, x_refsource_MLIST
• lists.apache.orgthread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf…web
• lists.apache.org[announce] 20170919 [SECURITY] CVE-2017-12615 Apache Tomcat Remote Code Execution via JSP uploadweb, Mailing list, x_refsource_MLIST
• lists.apache.orgthread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c…web
• lists.apache.org[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/web, Mailing list, x_refsource_MLIST
• lists.apache.orgthread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086…web
• lists.apache.org[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/web, Mailing list, x_refsource_MLIST
• lists.apache.orgthread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb13145…web
• lists.apache.org[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/web, Mailing list, x_refsource_MLIST
• github.combreaktoprotect/CVE-2017-12615web, x_refsource_MISC
• GitHub Security Advisoriesadvisories/GHSA-pjfr-qf3p-3q25advisory
• access.redhat.comRHSA-2018:0466web, Vendor advisory, x_refsource_REDHAT

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 06.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2017-12615","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T19:49:07.087509Z"}	{"id":"CVE-2017-12615","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2022-03-11T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 05.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2017-12615","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"slow"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2022-03-11T00:00:00+00:00"}	{"id":"CVE-2017-12615","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T19:49:07.087509Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0