Apache Tomcat Remote Code Execution Vulnerability (CVE-2025-24813)

Apache Tomcat is vulnerable to a critical remote code execution (RCE) flaw tracked as CVE-2025-24813. The vulnerability is rated at CVSS 10.0 and allows unauthenticated attackers to execute arbitrary code over the network without requiring user interaction. Impacted versions include Apache Tomcat releases prior to 9.0.99, 10.1.35, and 11.0.3, as well as specific earlier iterations in the 10.1.x and 11.0.x branches. Following the public disclosure, exploit scripts and multi-threaded scanning tools have been released on platforms like GitHub, significantly lowering the barrier for entry for malicious actors to identify and compromise exposed instances. Given the severity of the RCE and the presence of functional PoC code, organizations running affected Tomcat servers are at high risk of immediate compromise.

Impact

Successful exploitation of CVE-2025-24813 grants attackers full control over the vulnerable Apache Tomcat instance. As the vulnerability allows unauthenticated RCE, attackers can achieve complete system compromise, data exfiltration, and lateral movement within the network. The CVSS 10.0 score indicates that the impact on confidentiality, integrity, and availability is total, potentially affecting any enterprise environment using these versions of Tomcat for application hosting.

Recommendation

1. Patch Apache Tomcat to the latest versions (9.0.99, 10.1.35, or 11.0.3) immediately.
2. Inventory internet-facing Apache Tomcat instances and move them behind WAF/authentication layers if patching cannot be performed immediately.
3. Monitor web server logs for suspicious requests involving unexpected command injection attempts or unusual POST methods aimed at Tomcat endpoints.
4. Deploy detection logic to monitor for unexpected child processes spawned by the Tomcat Java process (e.g., cmd.exe, sh, or powershell.exe).