Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before

Summary

Apache Tomcat, a widely used Java web server, is affected when its JmxRemoteLifecycleListener is enabled and attackers can reach its JMX ports. Successful exploitation could allow an attacker to run arbitrary code on the affected server.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Apr 6, 2017, 9:00 PM UTCCVE published
2. May 12, 2023Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. Jun 2, 2023CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 21, 2025, 11:55 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, 9.x before 9.0.0.M12

• org.apache.tomcat:tomcat-catalina-jmx-remoteMaven

  fixed in 6.0.48

• org.apache.tomcat:tomcat-catalina-jmx-remoteMaven

  From 7.0.0 · fixed in 7.0.73

• org.apache.tomcat:tomcat-catalina-jmx-remoteMaven

  From 8.0.0 · fixed in 8.0.39

• org.apache.tomcat:tomcat-catalina-jmx-remoteMaven

  From 8.5.0 · fixed in 8.5.7

• org.apache.tomcat:tomcat-catalina-jmx-remoteMaven

  From 9.0.0.M1 · fixed in 9.0.0.M12

• org.apache.tomcat:tomcat-catalinaMaven

  fixed in 6.0.48

• org.apache.tomcat:tomcat-catalinaMaven

  From 7.0.0 · fixed in 7.0.73

• org.apache.tomcat:tomcat-catalinaMaven

  From 8.0.0 · fixed in 8.0.39

• org.apache.tomcat:tomcat-catalinaMaven

  From 8.5.0 · fixed in 8.5.7

• org.apache.tomcat:tomcat-catalinaMaven

  From 9.0.0.M1 · fixed in 9.0.0.M12

References 25