Is CVE-2017-12615 (Apache Tomcat on Windows Remote Code Execution) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2017-12615 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request.

What active exploitation means for CVE-2017-12615

This question is not just about whether a flaw exists. For CVE-2017-12615, the practical answer is that active exploitation changes the urgency, because a known-exploited issue should be treated as an incident-priority exposure, not a routine vulnerability backlog item. The key operational question is whether your Tomcat on Windows deployments still allow the request pattern that makes JSP upload possible.

When a vulnerability appears in the KEV catalogue, the response should shift from “plan to patch” to “confirm exposure, remove the exploit condition, and assume adversaries may already have tried it.” The same logic applies whether you are tracking it through the CISA Known Exploited Vulnerabilities Catalog or your own vulnerability management queue.

Why Tomcat on Windows creates a practical abuse path

The underlying issue is straightforward: if HTTP PUT is enabled, an attacker can attempt to upload a JSP file to the server via a specially crafted request. That turns a web-facing configuration choice into a code-execution path, which is why this class of flaw is so dangerous in exposed application servers.

The operating condition matters as much as the CVE itself. A Tomcat instance on Windows may be perfectly reachable, but if PUT is disabled and the deployment path is locked down, the abuse surface is materially smaller. If PUT is enabled or weakly controlled, the server can become a write target for hostile content rather than a read-only application endpoint.

What to verify, patch, and investigate first

Start by confirming whether any internet-facing or internally reachable Tomcat installations on Windows are still configured in a way that accepts PUT-based upload behaviour. Then validate whether those instances are still exposed to the relevant application paths, because the presence of the software alone does not tell you whether the exploit condition exists.

For operational triage, use the vendor advisory for the exact version and mitigation details, and use the CISA catalogue as the authoritative signal that the issue is known to be exploited. If you need a prioritisation frame for active exploitation, Zero-Day and Exploited Vulnerabilities Guide is a useful way to structure emergency response, especially when patch timing, validation, and post-patch hunting all matter.

Risk and Threat Considerations

Known exploitation means the exposure is no longer theoretical. For this class of server-side upload flaw, the main threat is unauthorised file placement followed by code execution under the application context, which can lead to webshell installation, persistence, and follow-on access. If the affected system is externally reachable, the attack window is often short once public reporting and exploit reuse begin.

Failure mechanism: Attackers send a crafted HTTP request that places a JSP file on the server, then invoke it through the web application stack to execute commands or deploy a backdoor.

Impact: Successful exploitation can produce remote code execution, loss of server integrity, post-exploitation lateral movement, and, in some environments, ransomware staging or broader compromise of adjacent systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid vulnerability prioritisation and remediation central.
Recommendation — Prioritise and remediate known-exploited exposures first.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	This is a vulnerability exploitation question that requires exposure validation and remediation.
Recommendation — Track, triage, and remediate the exposed Tomcat instances first.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about known exploited software flaw remediation and urgency.
Recommendation — Remediate the affected Tomcat configuration or release as soon as exposure is confirmed.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The abuse path is exploitation of a web-facing application server.
Recommendation — Map exposure to public-facing exploit paths and hunt for webshell activity.
OWASP ASVS	V4 — API and Web Service	The exploit depends on web request handling and upload behaviour in a server endpoint.
Recommendation — Review server request handling and restrict write-capable web endpoints.

Practitioner Guidance

What to prioritise: Treat exposed Tomcat on Windows hosts as urgent until you have confirmed the PUT condition is disabled or otherwise blocked. If you cannot immediately remediate, isolate the instance from untrusted networks and increase monitoring around webroot changes, unexpected JSPs, and unusual outbound activity.

What to verify: Confirm whether any uploaded or modified JSPs appeared outside normal release activity, whether web logs show suspicious PUT requests, and whether the server’s file timestamps or application logs indicate pre-patch access. If the host is shared or operationally sensitive, widen the review to adjacent directories and service accounts that could have been abused after initial execution.

Practitioner takeaway: Once a vulnerability is confirmed in KEV, the question is no longer “is it real?” but “has this system already been exposed to the exploit path, and what evidence do we still have to prove otherwise?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org