<p>Apache Tomcat is currently facing active attacks due to a critical remote code execution (RCE) vulnerability, identified as CVE-2025-24813. This flaw allows attackers to exploit servers using a straightforward method involving PUT requests. The simplicity of the attack has enabled rapid exploitation, just 30 hours after public disclosure, with reports indicating active abuse by various threat actors, including Chinese operators.</p>
<h3>Vulnerability Details</h3>
<p>The CVE-2025-24813 vulnerability affects the following Apache Tomcat versions:</p>
<ul>
<li><strong>11.0.0-M1 to 11.0.2</strong></li>
<li><strong>10.1.0-M1 to 10.1.34</strong></li>
<li><strong>9.0.0-M1 to 9.0.98</strong></li>
</ul>
<p>Attackers utilize a Base64-encoded payload which gets executed upon deserialization, granting remote access to the targeted servers. Furthermore, the vulnerability can also lead to information disclosure and content manipulation when exploited.</p>
<h3>Exploitation and Impact</h3>
<p>The severity of this vulnerability has been rated 8.6 out of 10 by Red Hat. Exploitation does not require authentication, significantly increasing the risk. The method involves a two-step process using PUT and GET requests, which bypasses many Web Application Firewalls (WAFs) due to its simplicity and encoding techniques. The attacks have been particularly effective when Tomcat uses file-based session storage.</p>
<h3>Mitigation Steps</h3>
<p>To mitigate the risks associated with CVE-2025-24813, it is strongly advised to upgrade to the following patched versions:</p>
<ul>
<li><strong>11.0.3 or later</strong></li>
<li><strong>10.1.35 or later</strong></li>
<li><strong>9.0.99 or later</strong></li>
</ul>
<p>Administrators are also recommended to disable risky features, apply stronger security measures, and implement real-time API security measures to prevent such attacks.</p>
<h3>Advisory Alerts</h3>
<p>CERT NZ has issued a critical advisory regarding this vulnerability, emphasizing the importance of immediate updates and enhanced security practices. Similarly, the Cybersecurity and Infrastructure Security Agency (CISA) has also raised warnings about the ongoing exploitation in the wild.</p>
<p>In conclusion, given the severity and the active exploitation of CVE-2025-24813, it is crucial for all Apache Tomcat users to update their systems without delay to protect against potential breaches and mitigate the associated risks.</p>


Collections

Apache Tomcat faces a critical remote code execution vulnerability identified as CVE-2025-24813, which is actively being exploited. This flaw, affecting versions 9.0.0-M1 to 11.0.2, allows attackers to gain remote access using a straightforward method involving PUT requests. The severity of the vulnerability is rated 8.6 out of 10. Apache Tomcat users are urged to upgrade to patched versions 11.0.3 or later, 10.1.35 or later, 9.0.99 or later to mitigate the risks, along with implementing enhanced security practices.

Critical Apache Tomcat Vulnerability CVE-2025-24813 Actively Exploited