CVE-2025-49124

What it actually does

This is a Windows installer untrusted search path vulnerability in Apache Tomcat. Affected Tomcat installers call icacls.exe without using an absolute path such as C:\Windows\System32\icacls.exe. On Windows, if an executable is invoked by name only, the operating system may search the current working directory and PATH locations before the intended system directory, depending on invocation context. If an attacker can place a malicious executable named icacls.exe in a directory searched by the installer, and the installer is run with elevated privileges, the attacker's executable can run with those installer privileges. This primarily affects installation or upgrade workflows on Windows, not normal Tomcat request processing after installation.

Why it matters to the business

Successful exploitation can turn a routine Tomcat installation or upgrade into local code execution with elevated privileges, potentially giving an attacker control of the Windows server, persistence, or the ability to tamper with the Tomcat deployment. The risk is most relevant where installers are launched from shared folders, Downloads directories, writable staging locations, software distribution caches, or other paths where lower-privileged users or compromised processes can place files. EPSS is low and this is not listed in CISA KEV or known ransomware use, but Windows servers running affected Tomcat installer versions should still be remediated because exploitation can provide a strong foothold during privileged maintenance activity.

How an attack unfolds

An attacker first needs local or adjacent write access to a directory that will be searched when the vulnerable Tomcat Windows installer runs. The attacker places a malicious executable named icacls.exe in that directory. An administrator, deployment tool, or software management process then launches an affected Tomcat installer from the same directory or from an environment where the malicious directory appears before the legitimate Windows system path. During installation, the Tomcat installer attempts to apply permissions by invoking icacls.exe without a full path. Windows resolves that executable name to the attacker-controlled copy rather than the legitimate C:\Windows\System32\icacls.exe. The malicious binary executes with the privileges of the installer process, which are commonly administrative. The attacker can then create users, install services, drop web shells or backdoors, alter Tomcat configuration, or establish persistence before optionally launching the legitimate icacls.exe to reduce visible installer failures.

How to fix it

Upgrade to fixed Apache Tomcat versions for Windows installer use: Tomcat 11.0.8 or later, Tomcat 10.1.42 or later, or Tomcat 9.0.106 or later. Affected ranges are Tomcat 11.0.0-M1 through 11.0.7, 10.1.0 through 10.1.41, and 9.0.23 through 9.0.105. If building from source, ensure the Tomcat fix corresponding to apache/tomcat commit 8a48dcb90f13f1670632e763e945f4cc9ef869e6 or later is present. Treat unrelated package mappings cautiously and prioritize the Apache Tomcat Windows installer advisory for this issue. As compensating controls, run installers only from trusted, administrator-controlled directories; remove write permissions for non-administrators from software staging paths; avoid launching privileged installers from Downloads, Temp, user profiles, or shared writeable folders; enforce application control so unexpected icacls.exe binaries outside C:\Windows\System32 and C:\Windows\SysWOW64 cannot execute; and use deployment tooling that verifies installer hashes and controlled working directories.

How to confirm the fix worked

Confirm that no affected Apache Tomcat Windows installer versions remain in use for installation or upgrade workflows. Verify installed or staged Tomcat installer packages are 11.0.8+, 10.1.42+, or 9.0.106+. On source-managed deployments, verify the Tomcat source includes the fix commit 8a48dcb90f13f1670632e763e945f4cc9ef869e6 or an equivalent later change. On Windows hosts, search installer staging locations, download folders, temporary directories, deployment shares, and software distribution caches for unexpected files named icacls.exe. Review endpoint telemetry to confirm that any icacls.exe executed during Tomcat installation resolved to C:\Windows\System32\icacls.exe or C:\Windows\SysWOW64\icacls.exe, not a working directory, user profile, share, or temporary path. If application control is available, test that execution of icacls.exe from non-system directories is blocked or alerted.

Typical attack path

1. Gain the ability to write files to a Tomcat installer staging, download, shared, temporary, or deployment directory on a Windows host.
2. Create or copy a malicious executable named icacls.exe into that writable directory.
3. Wait for or induce an administrator or software deployment process to run an affected Apache Tomcat Windows installer from that directory or with that directory early in the executable search path.
4. The installer invokes icacls.exe without an absolute path while running with elevated privileges.
5. Windows resolves icacls.exe to the attacker-controlled copy instead of the legitimate system binary.
6. The malicious executable runs with the installer's privileges and performs attacker actions such as persistence, credential access, service creation, payload deployment, or Tomcat tampering.
7. The attacker may execute the legitimate C:\Windows\System32\icacls.exe afterward to preserve expected installation behavior and reduce suspicion.

How to detect it

Look for evidence that the Tomcat Windows installer executed a non-standard icacls.exe. Primary log sources are Windows Security Event ID 4688 process creation, Sysmon Event ID 1 process creation, EDR process telemetry, PowerShell or software deployment logs, Windows Prefetch, Amcache, Shimcache, and file creation telemetry. Search for process executions where the image name is icacls.exe but the path is not C:\Windows\System32\icacls.exe or C:\Windows\SysWOW64\icacls.exe. Give higher priority to events where the parent process is an Apache Tomcat Windows installer, a software deployment agent, msiexec.exe, explorer.exe launched from an installer directory, or an elevated command shell. Also search for files named icacls.exe in Tomcat installer folders, user Downloads directories, Temp directories, shared deployment locations, and software distribution caches. Follow-on indicators may include new Windows services, scheduled tasks, unexpected local administrator membership changes, newly dropped executables, modified Tomcat configuration, suspicious files under Tomcat webapps, and outbound network connections shortly after installer execution. Because the issue has no public KEV listing and low EPSS, broad opportunistic exploitation is less likely, but local privilege-escalation attempts during maintenance windows should be investigated carefully.

• icacls.exe
• \\icacls.exe
• C:\\Windows\\System32\\icacls.exe
• C:\\Windows\\SysWOW64\\icacls.exe
• apache-tomcat-*-windows-*.exe
• tomcat*-windows-*.exe
• Image=*\\icacls.exe ParentImage=*apache-tomcat*
• Image=*\\icacls.exe ParentImage=*tomcat*
• Image=*\\icacls.exe ParentImage=*msiexec.exe
• Image=*\\icacls.exe ParentImage=*setup.exe
• Image=*\\icacls.exe ParentImage=*installer.exe
• OriginalFileName=icacls.exe
• EventCode=4688 NewProcessName=*\\icacls.exe
• EventID=1 Image=*\\icacls.exe
• C:\\Users\\*\\Downloads\\icacls.exe
• C:\\Users\\*\\AppData\\Local\\Temp\\icacls.exe
• C:\\Windows\\Temp\\icacls.exe
• C:\\ProgramData\\*\\icacls.exe
• \\\\*\\*\\icacls.exe
• ICACLS.EXE-*.pf

What your security team should do

• Inventory Windows systems and deployment pipelines that install or upgrade Apache Tomcat, and identify any use of Tomcat 11.0.0-M1 through 11.0.7, 10.1.0 through 10.1.41, or 9.0.23 through 9.0.105 installers.
• Upgrade Tomcat Windows installer packages to 11.0.8+, 10.1.42+, or 9.0.106+ and remove older installers from software repositories, file shares, golden images, and endpoint caches.
• Prioritize review of servers where Tomcat installers are run elevated from writable shares, user profile directories, Downloads folders, Temp directories, or endpoint management caches.
• Hunt for execution of icacls.exe from any path other than C:\Windows\System32\icacls.exe or C:\Windows\SysWOW64\icacls.exe, especially with a Tomcat installer as the parent process.
• Add detection or prevention rules for executable search-order hijacking patterns involving system utility names placed in installer directories.
• Restrict write access to software staging directories and require installer execution from trusted, administrator-controlled paths.
• Use application control, EDR blocking, or WDAC/AppLocker policies to prevent execution of binaries named icacls.exe outside trusted Windows directories.
• If suspicious execution is found, perform host triage for new services, scheduled tasks, local administrators, modified Tomcat files, web-accessible payloads, and credential theft artifacts.