What is the CVSS score of CVE-2016-4437?

CVE-2016-4437 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 94.2%.

Is there a public PoC exploit available for CVE-2016-4437?

Yes, a public proof-of-concept exploit is available for CVE-2016-4437. Prioritise patching immediately. EPSS: 94.2%.

Is there a patch available for CVE-2016-4437?

Yes, a patch is available for CVE-2016-4437. Update the affected software to the latest version immediately.

Shiro CVE-2016-4437

CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2016-06-07 secalert@redhat.com

RCE Apache Red Hat Fuse Shiro Aurora Jboss Middleware Text Only Advisories

9.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-321 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Key management, no hard-coded keys
Impact	CVSS score of 9.8 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. CISA has confirmed active exploitation in the wild. Public proof-of-concept exploit code is available. EPSS exploitation probability: 94.21%.
Exploit ScenarioDerived	This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the critical-severity affected system.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 94.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected Packages

maven org.apache.shiro:shiro-core fix: 1.2.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified under CWE-321. Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter. Affected products include: Apache Aurora, Apache Shiro, Redhat Fuse, Redhat Jboss Middleware Text-Only Advisories. Version information: before 1.2.5.

Know when Shiro gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Apr 21, 2026 - 15:31 CISA

CVE Published

Jun 07, 2016 - 14:06 cve.org

CRITICAL 9.8

DescriptionCVE.org

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

266 maven packages depend on org.apache.shiro:shiro-core (29 direct, 237 indirect)

Ecosystem-wide dependent count for version 1.2.5.

Threat Intelligence Overview

Threat Score

7.8/10

Composite threat intelligence

EPSS Score

94.2%

Top 0% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS POC (2)

Exploit-DB

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 94.2%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact· derived

High

Priority Score

228

Low Medium High Critical

KEV: +50

EPSS: +94

CVSS: +49

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:apache:aurora:*:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*

cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*

More in Shiro

View all

CVE-2014-0074 HIGH This Week POC

7.5 Oct 06

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to b

CVE-2016-6802 HIGH Act Now

7.5 Sep 20

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non

CVE-2023-34478 CRITICAL Act Now

9.8 Jul 24

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentic

CVE-2022-40664 CRITICAL Act Now

9.8 Oct 12

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatc

CVE-2022-32532 CRITICAL Act Now

9.8 Jun 29

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Rated c

CVE-2021-41303 CRITICAL Act Now

9.8 Sep 17

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authe

CVE-2020-17510 CRITICAL Act Now

9.8 Nov 05

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentica

CVE-2020-11989 CRITICAL Act Now

9.8 Jun 22

Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may caus

CVE-2020-1957 CRITICAL Act Now

9.8 Mar 25

Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may caus

CVE-2023-22602 HIGH This Week

7.5 Jan 14

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an auth

CVE-2020-13933 HIGH This Week

7.5 Aug 17

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

CVE-2019-12422 HIGH This Week

7.5 Nov 18

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding

Same weakness CWE-321 – Use of Hard-coded Cryptographic Key

View all

CVE-2025-30406 CRITICAL POC

9.0

CVE-2023-32077 HIGH POC

7.5

CVE-2025-13316 HIGH POC

8.2

CVE-2020-10884 HIGH POC

8.8

CVE-2025-57174 CRITICAL POC

9.8

CVE-2022-0664 CRITICAL POC

9.8

CVE-2026-74233 CRITICAL POC

9.3

CVE-2025-59407 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

References

Advisories & patches

ADVISORY https://vuldb.com/vuln/87768 REF http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html REF http://rhn.redhat.com/errata/RHSA-2016-2035.html REF http://rhn.redhat.com/errata/RHSA-2016-2036.html REF http://www.securityfocus.com/archive/1/538570/100/0/threaded REF http://www.securityfocus.com/bid/91024 REF https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4437

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back