Tomcat RCE Vulnerability Now Exploited in the Wild
Attackers are now exploiting a Remote Code Execution vulnerability in Apache Tomcat servers. It only takes a single API PUT and GET request combination to trigger a two-part attack that will upload and execute a malicious file…
API attacks are reaching levels never seen before in 2025. And as development rushes on, security teams are still struggling to keep up across all industries. The case we’re talking about today is a classic example of a vulnerability that was recognized, reported, but not resolved before attackers began to exploit it.
Apache Tomcat is a free, open-source Java web application server. The vulnerability in question was originally disclosed to the public on a Chinese forum by a user called iSee857. Contributors to the Apache open source project were presumably trying to resolve the issue, but it was already too late. Thirty hours after the post was made, attackers began to exploit the vulnerability in the wild, proving once again that bad actors are always waiting in the shadows to swoop in on any opportunity to strike.
The Vulnerability
The exploit works in two steps.
- The attacker uploads a serialized Java session file via PUT request
- The attacker triggers deserialization by referencing the malicious session ID in a GET request
The genius part of this attack is that it does not require any authentication to execute. The PUT request seems normal enough, and it seems that the API endpoint in question does not require further authentication checks by design. By the time the organization catches sight of any abnormalities, the malicious payload is already uploaded and deployed.
Every day, new vulnerabilities, attacks and breaches are popping up across platforms and industries. API security is more important now than ever as applications continue to rely on APIs to connect to one another. And as organizations continue to plow ahead without focusing on full, centralized API security, their applications, whether homegrown or relying on off-the-shelf third-party packages, are left vulnerable to attack, as in this case of Apache Tomcat.
FireTail is an end-to-end API and AI security platform for all your cybersecurity needs, starting with clear, centralized visibility at the application layer. To see how it works or try it out yourself, schedule a demo or go to our page for a free trial.
