Monday, 31 March, 2025

Critical Apache Tomcat Vulnerability (CVE-2025-24813) Actively Exploited for Remote Code Execution

A critical remote code execution (RCE) vulnerability, identified as CVE-2025-24813, has been discovered in Apache Tomcat versions 9.0.0-M1 to 9.0.98, 10.1.0-M1 to 10.1.34, and 11.0.0-M1. This flaw allows unauthenticated attackers to execute arbitrary code on affected servers by exploiting the handling of partial PUT requests and path equivalence. Active exploitation has been observed globally, with attackers targeting systems primarily in the United States, Japan, India, South Korea, and Mexico.