What are the Apache Tomcat and Camel vulnerabilities CVE-2025-24813, CVE-2025-27636, and CVE-2025-29891 and how are they being exploited in the wild?

Table of Contents

• What Happened?
• Why Are Apache Tomcat and Apache Camel Important?
• Breakdown of the Vulnerabilities
• How Are Hackers Exploiting These Vulnerabilities?
• How Widespread Is the Exploitation?
• How to Protect Your Systems
• Organizations at High Risk
• Real-World Consequences
• Conclusion
•  Frequently Asked Questions (FAQs)

What Happened?

In March 2025, cybersecurity researchers discovered three critical vulnerabilities affecting Apache Tomcat and Apache Camel, two widely used Java-based platforms in web and enterprise applications. These vulnerabilities are being actively exploited by cybercriminals in real-world attacks, with over 125,000 documented attempts across 70+ countries.

These vulnerabilities are:

• CVE-2025-24813 (Apache Tomcat)

  
  

• CVE-2025-27636 (Apache Camel)

• CVE-2025-29891 (Apache Camel)

The main threat? These flaws allow remote code execution (RCE) — enabling attackers to take control of servers without any authentication.

Why Are Apache Tomcat and Apache Camel Important?

Apache Tomcat:

An open-source Java-based web server used to run Java Servlets and render web pages that use Java Server Pages (JSP). It's commonly used in enterprise environments for hosting business applications.

Apache Camel:

An integration framework used for routing and transforming data across different systems. It powers many APIs and microservices inside businesses.

Because both are extensively deployed worldwide, any security flaw in them can put millions of users and data at risk.

Breakdown of the Vulnerabilities

These vulnerabilities allow threat actors to:

• Upload and execute malicious code.

• Escalate their privileges.

• Install backdoors for persistent access.

• Exfiltrate sensitive data or disrupt services.

How Are Hackers Exploiting These Vulnerabilities?

Hackers are using automated bots and scanners to find exposed Tomcat and Camel services across the internet. Once identified, they:

1. Exploit the CVEs to gain unauthorized access.

2. Run shell commands or malware to compromise the server.

3. Establish persistence using reverse shells or backdoors.

4. Launch further attacks, such as ransomware or data theft.

These exploits are often not detected immediately, making them highly dangerous.

How Widespread Is the Exploitation?

As of July 2025:

• 125,000+ attacks have been observed targeting these CVEs.

• Victims span finance, healthcare, government, and e-commerce sectors.

• Attackers are using IP obfuscation, proxies, and dynamic payloads to avoid detection.

How to Protect Your Systems

Immediate Actions for Admins:

✅ Apply security patches for Apache Tomcat and Camel as soon as possible.
✅ Check for Indicators of Compromise (IoCs) such as suspicious logs or unexpected Java processes.
✅ Use firewalls or WAFs to block unwanted traffic to your servers.
✅ Implement least privilege access and network segmentation.
✅ Monitor systems using Intrusion Detection Systems (IDS) like Snort or Suricata.
✅ Regularly back up important data and test recovery procedures.

Organizations at High Risk

You may be more vulnerable if:

• You use outdated versions of Apache Tomcat or Camel.

• Your servers are publicly accessible on the internet.

• You don’t have endpoint or log monitoring tools.

• Your DevOps or IT team is unaware of these specific CVEs.

Real-World Consequences

In one reported case, a global SaaS company running an unpatched Apache Camel instance was compromised in under 2 minutes after going live. The attackers:

• Installed a cryptominer to steal server resources.

• Set up a reverse shell to maintain remote access.

• Attempted lateral movement into connected systems.

This highlights the urgency for patch management and monitoring.

Conclusion

These Apache Tomcat and Camel vulnerabilities serve as a critical reminder: even trusted, widely-used platforms can become attack vectors if not maintained.

As a best practice:

• Always subscribe to vulnerability alerts for the software you use.

• Educate your IT team on common exploits and defenses.

• Keep your Java-based platforms updated and isolated from public networks unless necessary.

The sooner organizations react, the better chance they have at stopping these attacks before damage is done.

FAQs 

What are the latest vulnerabilities found in Apache Tomcat and Apache Camel?

The latest vulnerabilities are CVE-2025-24813, CVE-2025-27636, and CVE-2025-29891, allowing remote code execution and privilege escalation.

What is CVE-2025-24813?

It’s a critical flaw in Apache Tomcat that allows attackers to execute arbitrary code remotely.

What is CVE-2025-27636?

A vulnerability in Apache Camel enabling unauthorized execution of Java code remotely.

What is CVE-2025-29891?

It impacts Apache Camel and can lead to privilege escalation and unauthorized access.

How are hackers exploiting these Apache vulnerabilities?

Hackers use automated bots to find unpatched systems, then exploit these CVEs to gain access and install malware or steal data.

How many attacks have been recorded exploiting these vulnerabilities?

Over 125,000 attack attempts have been documented across 70+ countries.

Are Apache Tomcat and Camel widely used?

Yes, they are used globally in enterprise applications, APIs, and Java web hosting.

Can these vulnerabilities lead to ransomware attacks?

Yes, attackers can install ransomware after gaining access via remote code execution.

What is remote code execution (RCE)?

RCE allows hackers to run malicious code on a remote server without authorization.

Why are Java-based platforms targeted so often?

Java platforms like Tomcat and Camel are widely used, making them attractive targets for attackers.

Is this a zero-day vulnerability?

No, the vulnerabilities were disclosed in March 2025, but they are still being exploited.

What sectors are most at risk?

Finance, healthcare, education, and government organizations using Apache platforms are at high risk.

How can I check if my system is vulnerable?

Review the versions of Apache Tomcat and Camel in use and compare them with patched versions provided by Apache.

Has Apache released a patch for these CVEs?

Yes, Apache has issued security patches to address all three vulnerabilities.

What should system administrators do immediately?

Apply the latest security patches, monitor logs, and isolate vulnerable systems.

How do these vulnerabilities affect business operations?

They can lead to server shutdowns, data breaches, and financial losses.

Are these attacks still ongoing in July 2025?

Yes, exploitation continues as many systems remain unpatched.

What are the Indicators of Compromise (IoCs) for these exploits?

Unusual Java processes, unexpected command execution, or suspicious log entries may indicate compromise.

How do attackers remain undetected?

They use proxies, dynamic payloads, and stealth techniques like obfuscation.

Can intrusion detection systems (IDS) catch these attacks?

Yes, tools like Snort and Suricata can detect exploitation attempts if properly configured.

Is this related to supply chain attacks?

Not directly, but these vulnerabilities can be part of a broader attack chain once access is gained.

What programming languages are at risk in these attacks?

Primarily Java, since Apache Tomcat and Camel are Java-based frameworks.

Are small businesses affected too?

Yes, if they use vulnerable Apache components in their web apps or services.

Can antivirus software block these exploits?

Not always, especially if the exploit is executed through application-level logic.

Is cloud infrastructure at risk?

Yes, if Apache Tomcat or Camel are deployed in cloud-based environments without patches.

How do hackers find vulnerable systems?

Through internet scanning tools, Shodan, and known IP ranges using exposed Apache services.

Can firewalls prevent these exploits?

Firewalls can help block unauthorized traffic but are not a full defense against known vulnerabilities.

How can DevOps teams secure Apache Tomcat and Camel?

Implement CI/CD security checks, regular patching, and vulnerability scanning.

What other tools can help detect Apache exploits?

Use tools like Nessus, OpenVAS, and Burp Suite to scan for these CVEs.

Why is patching delayed in many organizations?

Lack of awareness, fear of downtime, and complex update procedures often delay patching.