CVE-2016-6794: Apache Tomcat

Medium severity, CVSS 5.3. EPSS: 7.2% chance of exploitation in the next 30 days.

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

Affected products

• Apache Tomcat: from 6.0.0, up to and including 6.0.45; from 7.0.0, up to and including 7.0.70; from 8.0, up to and including 8.0.36; from 8.5.0, up to and including 8.5.4; version 9.0.0 only
• Canonical Ubuntu Linux: version 16.04 only
• Debian Debian Linux: version 8.0 only
• Netapp Oncommand Insight: affected versions not specified
• Netapp Oncommand Shift: affected versions not specified
• Netapp Snap Creator Framework: affected versions not specified
• Oracle Tekelec Platform Distribution: from 7.4.0, up to and including 7.7.1
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Eus: version 7.4 only; version 7.5 only; version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Workstation: version 7.0 only
• Red Hat JBoss Enterprise Web Server: version 3.0.0 only

Published 2017-08-10. Last modified 2026-06-17.