CVE-2017-12615VulnerabilityPublished 03/25/2022Updated 10/24/2026
CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability
Affects Apache TomcatSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 03/25/2022
- KEV deadline
- 04/15/2022
- Ransomware
- Used in ransomware campaigns
- EPSS
- 99.6% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
CVE-2017-12615 is a remote code execution vulnerability in Apache Tomcat running on Windows when HTTP PUT requests are enabled. An attacker can upload a JSP file via a crafted request, which can then be executed on the server, allowing arbitrary code execution. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.