{"cve_id":"CVE-2016-8735","published":"2017-04-06T21:59:00.243000+00:00","last_modified":"2026-08-25T16:28:27.310000+00:00","vuln_status":"Analyzed","description":"Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","base_score":9.8,"base_severity":"CRITICAL","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":[],"in_kev":true,"kev_date_added":"2023-05-12","kev_ransomware":false,"epss_score":0.90338,"epss_percentile":0.99798,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"medium","ingested_at":"2026-09-18T08:34:05.756263+00:00","first_seen":"2017-04-06T21:59:00.243000+00:00","kev_first_seen":"2023-05-12T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["apache","canonical","debian","netapp","oracle","redhat"],"products":["7-mode_transition_tool","agile_engineering_data_management","agile_product_lifecycle_management","communications_application_session_controller","communications_instant_messaging_server","communications_interactive_session_recorder","debian_linux","hospitality_guest_access","jboss_enterprise_web_server","micros_relate_crm_software","micros_retail_xbri_loss_prevention","mysql_enterprise_monitor","oncommand_insight","oncommand_shift","retail_convenience_and_fuel_pos_software","snap_creator_framework","tomcat","transportation_management","ubuntu_linux"],"affected":[{"vendor":"apache","product":"tomcat","ranges":["< 6.0.48","≥ 7.0.0 and < 7.0.73","≥ 8.0 and < 8.0.39","≥ 8.5.0 and < 8.5.7","9.0.0"]},{"vendor":"canonical","product":"ubuntu_linux","ranges":["16.04"]},{"vendor":"debian","product":"debian_linux","ranges":["8.0"]},{"vendor":"netapp","product":"7-mode_transition_tool","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_insight","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_shift","ranges":["all versions"]},{"vendor":"netapp","product":"snap_creator_framework","ranges":["all versions"]},{"vendor":"oracle","product":"agile_engineering_data_management","ranges":["6.2.0","6.1.3","6.2.1.0"]},{"vendor":"oracle","product":"agile_product_lifecycle_management","ranges":["9.3.5","9.3.6"]},{"vendor":"oracle","product":"communications_application_session_controller","ranges":["3.8.0","3.7.1"]},{"vendor":"oracle","product":"communications_instant_messaging_server","ranges":["10.0.1"]},{"vendor":"oracle","product":"communications_interactive_session_recorder","ranges":["6.2","6.0","6.1"]},{"vendor":"oracle","product":"hospitality_guest_access","ranges":["4.2.1","4.2.0"]},{"vendor":"oracle","product":"micros_relate_crm_software","ranges":["10.8","11.4"]},{"vendor":"oracle","product":"micros_retail_xbri_loss_prevention","ranges":["10.7.7","10.8.1","10.8.0","10.0.1","10.5.0","10.6.0"]},{"vendor":"oracle","product":"mysql_enterprise_monitor","ranges":["≥ 3.4.0 and ≤ 3.4.2.4181","≤ 3.2.8.2223","≥ 3.3.0 and ≤ 3.3.4.3247"]},{"vendor":"oracle","product":"retail_convenience_and_fuel_pos_software","ranges":["2.1.132"]},{"vendor":"oracle","product":"transportation_management","ranges":["6.3.7","6.3.0","6.3.1","6.3.2","6.3.3","6.3.4","6.3.5","6.3.6"]},{"vendor":"redhat","product":"jboss_enterprise_web_server","ranges":["3.0.0"]}]}