CVE-2017-12617: Apache Tomcat Default Servlet JSP upload leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw allows unauthenticated remote code execution, is listed in CISA KEV and has an EPSS probability near 1.0, so it is actively exploited and must be remediated immediately.

What it is

Apache Tomcat with HTTP PUT enabled (for example, the Default servlet readonly parameter set to false) allows an attacker to upload a JSP file through a crafted request. The uploaded JSP can then be requested and executed by the server, giving code execution in the Tomcat process. The flaw affects Tomcat 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81.

Impact

An attacker gains arbitrary code execution with the privileges of the Tomcat service, which can lead to full server compromise, data theft or lateral movement. No credentials are needed if PUT is reachable.

Attack surface

Reached over the network via HTTP PUT requests to a Tomcat instance where write access is enabled on the Default servlet. No authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N), though the attack complexity is rated high.

Exploitation

CVE-2017-12617 is listed in CISA KEV (added 2022-03-25) and has an EPSS 30-day probability of 0.99988, indicating active exploitation in the wild. References are patch and advisory links; no ransomware campaign use is documented.

What to do

• Upgrade Apache Tomcat to a fixed release for your branch (9.0.1 or later, 8.5.23 or later, 8.0.47 or later, 7.0.82 or later) or apply the vendor patch.
• Disable HTTP PUT on the Default servlet by keeping the readonly initialization parameter set to true.
• Restrict network access to Tomcat management and application ports to trusted hosts only.
• Remove or disable the Default servlet write capability and any unnecessary WebDAV or PUT handlers.
• Monitor and alert on unexpected JSP files appearing in web-accessible directories.

Detection

• Search web server and Tomcat access logs for PUT requests returning 2xx status codes, especially those targeting .jsp paths.
• Monitor web-accessible directories for newly created or modified JSP files and alert on unexpected writes.
• Look for outbound connections or child processes spawned by the Tomcat service that are inconsistent with normal application behavior.
• Correlate PUT requests with subsequent GET requests to the same JSP file within a short time window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.