Attackers are actively exploiting a critical Apache Tomcat RCE flaw to take over servers with a PUT request; Wallarm: the attack “requires no authentication”
A critical remote code execution (RCE) vulnerability in Apache Tomcat tracked as CVE-2025-24813 is actively exploited in the wild …
Context & Ripple Effects
This is the latest example of an internet-facing server flaw moving rapidly from disclosure to active exploitation. Related coverage has repeatedly shown that unpatched RCEs in hosting and application infrastructure draw attacks, including exploitation of an unpatched hosting-control-panel RCE and an actively exploited Apache server flaw.
It also recalls the long-lived exposure created by critical Java web-stack vulnerabilities such as the Apache Struts flaw affecting enterprise web applications. Tomcat's role in application delivery makes unauthenticated server takeover especially consequential for organizations that expose or operate affected instances.
First-order effects
- Organizations running affected Apache Tomcat deployments face immediate risk of remote server compromise through an unauthenticated PUT-based attack, making CVE-2025-24813 an urgent exposure for security and operations teams.
- Wallarm's report gives defenders a concrete exploitation condition to prioritize in vulnerability triage: exposed affected Tomcat servers can be targeted without valid credentials.
Second-order effects
- Managed hosting providers, application operators, and security teams will need to accelerate asset discovery and patch or mitigation workflows, since a compromise of a shared or externally reachable server can affect multiple applications.
- Detection and response teams are likely to prioritize telemetry around unusual PUT activity and possible post-compromise behavior, while attackers can reuse the same low-friction entry point against lagging deployments.
Third-order effects
- The incident reinforces that web-server and Java application-stack vulnerabilities remain a concentrated source of systemic risk: a single unauthenticated RCE can turn routine patch lag into broad server exposure.
- If exploitation continues to appear quickly after critical disclosures, organizations will face greater pressure to reduce unknown internet-facing assets and shorten the path from vulnerability identification to remediation.
The trend: This is one data point in the continuing shift toward treating actively exploited, unauthenticated RCEs in internet-facing infrastructure as immediate operational incidents rather than routine patch-management work.