CVE-2009-3843: HP Operations Manager hidden Tomcat account enables unrestricted file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score is 10.0 with network reachability, no authentication, and complete confidentiality, integrity, and availability impact, and EPSS is 0.79 at the 99.6th percentile.

What it is

HP Operations Manager 8.10 on Windows ships an XML file defining Tomcat users that contains a hidden account. That account can reach the Tomcat manager HTMLManagerServlet and perform unrestricted file uploads, leading to arbitrary code execution.

Impact

A remote attacker can upload and execute arbitrary code with the privileges of the Tomcat service, giving full control of the affected host.

Attack surface

Reachable over the network via HTTP requests to manager/html/upload on the Tomcat manager interface. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication or user interaction is required, because the hidden account credentials are embedded in the product.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is very high (0.79, 99.6th percentile), and references include a Zero Day Initiative advisory, but no reference is tagged as exploit code or active exploitation.

What to do

• Apply the HP vendor fix for Operations Manager 8.10 on Windows; check the Secunia vendor advisory and HP support channels for the patched build.
• Remove or disable the hidden Tomcat user account in the Tomcat users XML configuration and rotate any credentials found there.
• Restrict network access to the Tomcat manager interface (manager/html) to trusted management hosts only, and disable the manager web application if it is not required.
• Run the Tomcat service under a least-privilege account and isolate the Operations Manager host from untrusted networks.

Detection

• Monitor Tomcat access logs for POST requests to /manager/html/upload and for access to /manager/html from unexpected source IPs.
• Alert on new or modified files in Tomcat web application deployment directories and on unexpected child processes spawned by the Tomcat service.
• Audit the Tomcat users XML file for accounts not present in the documented configuration, especially any hidden or default entries.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.