CVE-2016-8735

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is a remote code execution flaw in Apache Tomcat versions prior to 6.0.48, 7.0.73, 8.0.39, 8.5.7, and 9.0.0.M12. It stems from the JmxRemoteLifecycleListener component, which was not updated to align with the credential type handling changes introduced by the Oracle patch for CVE-2016-3427, allowing unsafe deserialization or credential processing over JMX.

An unauthenticated attacker who can reach the JMX ports exposed by a Tomcat instance using this listener can exploit the issue to execute arbitrary code on the server. The flaw requires no user interaction and carries a CVSS 3.1 base score of 9.8 due to its network-accessible nature and full impact on confidentiality, integrity, and availability.

Advisories such as Red Hat RHSA-2017-0457 and the Apache SVN revisions (1767644, 1767656, 1767676) direct users to upgrade to the fixed Tomcat releases. They also recommend disabling or restricting access to JMX ports when the listener is not required, along with applying the corresponding Oracle JVM patches for consistent credential handling.