CVE-2010-4094: IBM Rational Tomcat default ADMIN password enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityDefault administrative credentials on an internet-reachable Tomcat manager lead directly to remote code execution, and the high EPSS score signals active exploitation likelihood despite the medium CVSS base score.

What it is

The Tomcat server bundled with IBM Rational Quality Manager and Rational Test Lab Manager ships with a default password for the ADMIN account. Anyone who can reach the Tomcat manager interface can log in with those known credentials and deploy or execute code under the manager role. The flaw is a classic default-credentials issue (CWE-255) and matters because it turns an exposed management interface into a remote code execution path.

Impact

An attacker gains the Tomcat manager role and can execute arbitrary code on the host, leading to full compromise of the application server. The CVSS vector scores only partial integrity impact, but the description's code execution outcome is more severe than that score suggests.

Attack surface

Reachable over the network via the Tomcat manager interface (AV:N, no authentication required to attempt the default credentials, no user interaction). The attacker only needs network access to the Tomcat service; the default ADMIN password supplies the authentication.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at 0.645 (99.2nd percentile), indicating elevated likelihood of exploitation activity. Reference tags are limited to a single Vendor Advisory, with no public exploit tag in the record.

What to do

• Apply the IBM vendor update referenced in the advisory and update log to remove or change the default ADMIN credentials.
• Immediately change the Tomcat ADMIN account password on any Rational Quality Manager or Rational Test Lab Manager deployment.
• Restrict network access to the Tomcat manager interface to trusted administrative hosts only.
• Disable or remove the Tomcat manager web application if it is not required for operations.
• Audit for any other default or shared credentials in the Rational deployment.

Detection

• Monitor Tomcat manager login events for the ADMIN account, especially successful logins from unexpected source IPs.
• Alert on deployment of new WAR files or other artifacts through the Tomcat manager interface.
• Review Tomcat access logs for requests to /manager paths outside normal administrative windows.
• Check for unexpected processes or child processes spawned by the Tomcat service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.