Apache Tomcat JmxRemoteLifecycleListener Deserialization Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2016-8735)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled
Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges
Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Apache Tomcat to a non-vulnerable version. Below are the commands to stop the service and deploy an updated version on Linux.
# Stop the running Tomcat service
sudo systemctl stop tomcat
# Download and extract the latest secure version (e.g., Tomcat 8.5.100)
cd /opt
sudo wget https://archive.apache.org/dist/tomcat/tomcat-8/v8.5.100/bin/apache-tomcat-8.5.100.tar.gz
sudo tar -zxvf apache-tomcat-8.5.100.tar.gz
# Restore configuration files and webapps (ensure the vulnerable listener is not re-enabled)2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, comment out or remove the JmxRemoteLifecycleListener declaration in conf/server.xml and block external access to the JMX ports.
<!-- Locate and comment out the following listener in conf/server.xml -->
<!--
<Listener className='org.apache.catalina.mbeans.JmxRemoteLifecycleListener'
rmiServerPortPlatform='10002' rmiRegistryPortPlatform='10001' />
--># Block external access to JMX ports (e.g., 10001, 10002) using iptables
sudo iptables -A INPUT -p tcp --dport 10001 -j DROP
sudo iptables -A INPUT -p tcp --dport 10002 -j DROP3. Log Audit & IoC Verification Commands
Use the following shell script to scan your Tomcat configuration files and detect if the vulnerable listener is active.
#!/bin/bash
# Scan server.xml for active JmxRemoteLifecycleListener configurations
CONF_FILE='/opt/tomcat/conf/server.xml'
if [ -f '$CONF_FILE' ]; then
ACTIVE_LISTENER=$(grep -i 'JmxRemoteLifecycleListener' '$CONF_FILE' | grep -v '<!--')
if [ ! -z '$ACTIVE_LISTENER' ]; then
echo '[WARNING] JmxRemoteLifecycleListener is active and potentially vulnerable:'
echo '$ACTIVE_LISTENER'
else
echo '[OK] JmxRemoteLifecycleListener is disabled or commented out.'
fi
else
echo '[INFO] Tomcat server.xml not found at the specified path.'
fiBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2016-8735) is a critical remote code execution flaw residing in Apache Tomcat's JmxRemoteLifecycleListener component. This listener is designed to create a JMX remote connector to facilitate remote monitoring of the platform MBean server. However, when Oracle released a security patch (CVE-2016-3427) to address deserialization issues in JMX credential handling, Tomcat's corresponding listener was not updated to maintain consistency with these credential type validations. This omission left the listener vulnerable to the deserialization of untrusted data.
2. Exploitation Mechanics & Attack Scenario
An attacker begins by scanning for exposed JMX ports (configured via the listener) on target Tomcat servers. If the port is accessible, the attacker initiates a connection and transmits a serialized malicious Java object via the JMX RMI protocol. Because the JmxRemoteLifecycleListener fails to properly validate and filter incoming credential types and serialized payloads, it attempts to deserialize the incoming stream. This triggers a gadget chain (such as Apache Commons Collections payloads), bypassing authentication entirely and executing arbitrary operating system commands under the context of the Tomcat process.
3. Infrastructure & Business Impact
With a CVSS 3.1 score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation grants the attacker full control over the Tomcat application server. This can lead to complete infrastructure compromise, lateral movement within the internal network, data exfiltration, and deployment of ransomware, resulting in severe operational disruption and reputational damage.
Official Vendor Advisories & References
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Frequently Asked SecOps Questions (CVE-2016-8735)
FAQQ1. How critical is CVE-2016-8735 and is it actively exploited in the wild?
CVE-2016-8735 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 90.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2016-8735?
Primary impacted vendors include apache across tomcat. Scope summary: Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12
Q3. What temporary mitigations or workarounds exist for CVE-2016-8735 before patching?
[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2016-8735
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.