A critical vulnerability in Apache Tomcat has been actively exploited by attackers to achieve remote code execution (RCE) on vulnerable servers.

This vulnerability affects versions 9.0.0-M1 to 9.0.98, 10.1.0-M1 to 10.1.34, and 11.0.0-M1 to 11.0.2 and has been resolved in versions 9.0.99, 10.1.35, and 11.0.3.

The flaw exploits Apache Tomcat’s handling of partial PUT requests and path equivalence, allowing attackers to bypass security constraints and execute arbitrary code without authentication under specific conditions.

Apache Tomcat Vulnerability — *Vulnerability Intelligence Card for CVE-2025-24813*

Exploitation Techniques and Impact

According to Insikt Group, the exploitation involves a two-step process. First, attackers send a PUT request with a maliciously crafted, serialized Java payload to a writable directory.

This payload is designed to trigger RCE upon deserialization. Then, a GET request is sent with a specially crafted “JSESSIONID” cookie, causing the server to deserialize the payload and execute arbitrary code.

Successful exploitation requires specific conditions, including write permissions for the default servlet, partial PUT support, and the use of file-based session persistence with a deserialization-vulnerable library.

These conditions are not typically met by default, limiting the scope of exploitation. Active exploitation attempts have been observed globally, with attackers targeting systems primarily in the United States, Japan, India, South Korea, and Mexico.

The rapid availability of proof-of-concept (PoC) exploits has lowered the barrier for exploitation, allowing even less sophisticated attackers to attempt to exploit this vulnerability.

Despite these attempts, successful exploitation is challenging due to the specific prerequisites required.

Mitigations

To mitigate the risks associated with CVE-2025-24813, organizations should upgrade to the patched versions of Apache Tomcat (9.0.99, 10.1.35, or 11.0.3) as soon as possible.

For instances where upgrading is not immediately feasible, implementing network-level controls to restrict access to the Tomcat server can provide temporary protection.

Additionally, disabling unnecessary HTTP methods and enforcing strict access controls can further reduce the risk of exploitation.

To detect and block malicious traffic, continuous monitoring for threat indicators and the use of web application firewalls (WAFs) are also recommended.

The post Apache Tomcat Vulnerability (CVE-2025-24813) Exploited to Execute Code on Servers appeared first on Cyber Security News.