CVE-2016-4437: Apache Shiro hardcoded remember-me cipher key enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, active exploitation in CISA KEV, near-maximum EPSS, and public exploit code make this an urgent patch target.

What it is

Apache Shiro before 1.2.5 uses a default cipher key for the "remember me" feature when no key is configured, allowing attackers to forge or decrypt remember-me cookies. Because the cookie is deserialized, a crafted value can lead to remote code execution or authentication bypass. The flaw is remotely reachable without credentials and is listed in CISA KEV, making it a high-value target for defenders.

Impact

An unauthenticated attacker can execute arbitrary code on the server or bypass access restrictions, potentially gaining full control of the application and underlying host.

Attack surface

Reached over the network via HTTP requests carrying a crafted remember-me cookie or request parameter; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA KEV lists it as actively exploited (added 2021-11-03), EPSS 30-day probability is 0.93039 (99.8th percentile), and references include an Exploit-tagged Packet Storm entry, indicating public exploit code exists.

What to do

• Upgrade Apache Shiro to 1.2.5 or later, or apply the vendor patch for your distribution (e.g., Red Hat RHSA-2016-2035/RHSA-2016-2036).
• Configure a unique, strong cipher key for the remember-me feature instead of relying on the default.
• Disable the remember-me feature if it is not required by the application.
• Rotate any existing remember-me cookies and invalidate sessions after patching.
• Restrict network exposure of Shiro-based applications and monitor for anomalous cookie values.

Detection

• Inspect HTTP requests for remember-me cookies containing base64-encoded serialized Java objects or unusually long values.
• Monitor application and server logs for deserialization errors or unexpected class loading tied to cookie processing.
• Use network detection to flag known Shiro exploit payloads or signatures targeting the remember-me parameter.
• Alert on outbound connections or process creation from the application server that correlate with cookie-handling requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.