Critical RCE flaw in Apache Tomcat actively exploited in attacks

A critical remote code execution (RCE) vulnerability in Apache Tomcat tracked as CVE-2025-24813 is actively exploited in the wild, enabling attackers to take over servers with a simple PUT request. Hackers are reportedly leveraging proof-of-concept (PoC) exploits that were published on GitHub just 30 hours after the flaw was disclosed last week. The malicious activity was confirmed by Wallarm security researchers, who warned that traditional security tools fail to detect it as PUT requests appear normal and the malicious content is obfuscated using base64 encoding. Specifically, the attacker sends a PUT request containing a base64-encoded serialized Java payload saved to Tomcat's session storage. The attacker then sends a GET request with a JSESSIONID cookie pointing to the uploaded session file, forcing Tomcat to deserialize and execute the malicious Java code, granting complete control to the attacker. The attack does not require authentication and is caused by Tomcat accepting partial PUT requests and its default session persistence. "This attack is dead simple to execute and requires no authentication," explains Wallarm. "The only requirement is that Tomcat is using file-based session storage, which is common in many deployments. Worse, base64 encoding allows the exploit to bypass most traditional security filters, making detection challenging." The CVE-2025-24813 remote code execution vulnerability flaw was first disclosed by Apache on March 10, 2025, impacting Apache T...