VULNpocalypse
Exploited vulnerabilitiesBriefPublic record

Apache Tomcat partial-PUT RCE (CVE-2025-24813)

Disclosed 10 Mar 2025. Exploited within about 30 hours of the PoC.

Disclosed

What happened

  • Disclosed 10 Mar 2025. Exploited within about 30 hours of the PoC. KEV: 1 Apr 2025.
  • Affected: 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, 9.0.0.M1 to 9.0.98. Fixed: 11.0.3, 10.1.35, 9.0.99.
  • Precondition: the default servlet has writes enabled and file-based session persistence is used.

Live scores

Live scores

CVE-2025-24813
EPSS
0.999
very likely to be attacked soon
VEDAS
0.978
strong exploit evidence
On CISA KEV
Yes, since 2025-04-01
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.1CVE-2025-24813 EPSS over time2025-042026-11-01
VEDAS (exploit evidence)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.9CVE-2025-24813 VEDAS over time2025-042026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Sources

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.