Secuno
ENNL
Book demo

CVE-2016-4437

Apache Shiro Code Execution

9.8 CRITICALActively exploited (CISA KEV)Public exploitEPSS 93.0%
  1. Published7 Jun 2016
  2. Added to CISA KEV3 Nov 2021
  3. Remediation due3 May 2022
Actively exploited (CISA KEV)

Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.

Added to KEV: 3 Nov 2021Federal remediation due: 3 May 2022

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Aurora≥ 0.10.0 < 0.18.1
Apache Shiro< 1.2.5
Redhat Fuse1.0
Redhat Jboss Middleware Text-only Advisories1.0

Remediation

Fixed in
Apache Aurora≥ 0.18.1
Apache Shiro≥ 1.2.5

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1088609.1
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows…
CVE-2026-945918.4
Armatura One stores database and message-broker credentials in an install configuration…
CVE-2026-828279.8
Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded…
CVE-2026-107648.7
Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle…
CVE-2026-181818.1
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote…
CVE-2026-8670810.0
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to…

Frequently asked

Is CVE-2016-4437 being actively exploited?

Yes. CVE-2016-4437 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2016-4437?

CVE-2016-4437 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 93.0% probability of exploitation.

Which products are affected by CVE-2016-4437?

Affected products include Apache Aurora, Apache Shiro, Redhat Fuse, Redhat Jboss Middleware Text-only Advisories.

How do I fix CVE-2016-4437?

Upgrade affected software to a fixed version, for example Apache Aurora 0.18.1, Apache Shiro 1.2.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2016-4437 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.