Grey Noise Observes Active Exploitation of Critical Apache Tomcat RCE Vulnerability (CVE-2025-24813)
Summary: GreyNoise reports active exploitation of CVE-2025-24813, a newly disclosed Apache Tomcat vulnerability that could enable remote code execution, with four unique IPs attempting exploits since March 17, 2025, using a partial PUT method to inject malicious payloads. Over 70% of exploit sessions targeted U.S.-based systems, with other attempts aimed at Japan, India, South Korea, and Mexico, and GreyNoise says the traffic is currently limited to naive attackers using PoC code.
Bottom line: Apache Tomcat's widespread deployment means these early attempts from four IPs are likely a preview rather than the full campaign, and with over 70% of sessions already pointed at U.S. systems, unpatched Tomcat instances are the exposure to close first.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-24813
- Related
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability Known Exploited Vulnerabilities · Apr 01, 2025