CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

Overview Sources History

What happened

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Affected versions

Tomcat: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

Review the original advisory and validate affected versions.
Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference

SploitusJexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server. It is written in Python and can be used to check for vulnerabilities in versions 3, 4, 5, and 6 of the JBoss Application Server using different exploitation vectors such as /jmx-console, /web-console/Invoker, and /invoker/JMXInvokerServlet. The tool allows for automated exploitation via "jmx-console" and provides a command shell to execute commands on the serverKitPloit2026-09-26T16:07:01Candidate kitploit.comJexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server. It is written in Python and can be used to check for vulnerabilities in versions 3, 4, 5, and 6 of the JBoss Application Server using different exploitation vectors such as /jmx-console, /web-console/Invoker, and /invoker/JMXInvokerServlet. The tool allows for automated exploitation via "jmx-console" and provides a command shell to execute commands on the serveren2026-09-26T16:07:01Candidate

Corrections Report an issue

Apache Tomcat Remote Code Execution Vulnerability