Exposed Apache Tomcat Manager logins and password spraying
The short version: An Apache Tomcat Manager login exposed to the internet lets attackers spray default and common passwords until one works — and access to the Manager interface can mean deploying a web application of the attacker's choosing, which is a short path to running code on the server.
What you need to know
There's no CVE here and nothing to patch. The weakness is the combination of exposure and weak authentication on a powerful interface: the Tomcat Manager app, which is meant for administration and ships behind credentials that are famously left at defaults.
Password spraying and default-credential guessing turn that combination into a breach. Attackers try well-known Tomcat defaults (admin/admin, tomcat/tomcat, manager/manager, and similar) and common passwords across known usernames, at a pace that stays under lockout thresholds.
- How they find it — internet-wide scanning surfaces the
/manager/htmlinterface, which is trivial to fingerprint as Tomcat. - How they use it — automated guessing with default and common credentials.
- What it leads to — the Manager interface can deploy and undeploy web applications. An attacker who authenticates can upload a malicious WAR and obtain code execution on the server — full host compromise, not just a login.
How serious we see it
High. This isn't a default-Moderate user login — the Manager interface is an administrative control that leads to code execution, so we rate it by where it goes. As the threat definition itself notes, authenticating to this interface can lead to full system compromise. The bounded, reassuring note: it's entirely in your hands to fix, needs no vendor patch, and the primary control — keeping the Manager app off the public internet — closes it outright.
What to do
- Get the Manager interface off the public internet — restrict
/managerand/host-managerto trusted networks or a management VPN. This is the control that matters most. - Change every default credential — remove or re-credential the default Tomcat accounts; never ship defaults to production.
- Enforce strong, unique passwords — and check them against known-breached lists.
- Limit and monitor failed authentication — alert on guessing patterns against the Manager app.
- Confirm your exposure first — verify whether the Tomcat Manager interface is reachable from the internet at all.
How BreachRisk sees it
BreachRisk discovers exposed Apache Tomcat Manager interfaces in your external footprint the way an attacker would — by crawling and fingerprinting the /manager/html panel — and then, where authorized, goes a step further than a scanner: it safely attempts a bounded, rate-limited authentication check using default, common, and exposed (breach-corpus) credentials, within strict non-disruptive limits rather than a brute-force flood. That's the honest difference between detecting an admin panel and demonstrating whether it actually holds. An internet-facing Tomcat Manager with default credentials is exactly the kind of exposure you want surfaced — and answered — before someone else deploys code through it.