CVE-2016-8735: Apache Tomcat JmxRemoteLifecycleListener remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, KEV listing with a past due date, and EPSS near 0.90 make this an actively exploited, unauthenticated RCE.

What it is

Apache Tomcat's JmxRemoteLifecycleListener was not updated to match the Oracle CVE-2016-3427 credential-type fix, leaving a deserialization weakness that allows remote code execution. It affects Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 when that listener is enabled and JMX ports are reachable. Because it is network-reachable with no authentication or user interaction, it is a serious exposure for any host exposing JMX.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the Tomcat process, leading to full host compromise.

Attack surface

Reached over the network via exposed JMX ports on Tomcat instances that use JmxRemoteLifecycleListener; the CVSS vector shows no privileges or user interaction required.

Exploitation

CVE-2016-8735 is listed in CISA KEV with a 2023-06-02 remediation due date, and EPSS gives a 30-day probability of about 0.90 (99.8th percentile), indicating active exploitation and high likelihood. No ransomware campaign use is documented.

What to do

• Upgrade Tomcat to a fixed release: 6.0.48, 7.0.73, 8.0.39, 8.5.7, or 9.0.0.M12 and later, per vendor advisories.
• If JmxRemoteLifecycleListener is not required, remove it from server configuration.
• Restrict JMX/RMI ports with firewall rules and bind to management interfaces only, never the public internet.
• Apply the referenced Oracle, Red Hat, Debian and other vendor patches for bundled Tomcat components.
• Verify the credential-type fix is present, since the flaw stems from missing the CVE-2016-3427 consistency update.

Detection

• Monitor network traffic to JMX/RMI ports for unexpected external connections or serialized payloads.
• Audit Tomcat server.xml for JmxRemoteLifecycleListener usage and flag exposed JMX ports.
• Alert on suspicious child processes or command execution spawned by the Tomcat JVM.
• Track Tomcat versions in inventory against the fixed release list and flag unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.