Researchers have identified a critical remote code execution (RCE) vulnerability, tracked as CVE-2025-24813, in Apache Tomcat that is being actively exploited, allowing attackers to take control of vulnerable Tomcat servers using a simple PUT API request. Hackers have leveraged proof-of-concept (PoC) exploits published on GitHub shortly after disclosure. The attack involves sending a base64-encoded serialized Java payload via a PUT request, allowing the exploit to bypass most traditional security filters. Apache Tomcat then deserializes and executes the payload, granting the attacker full system control without authentication. Traditional security tools struggle to detect the exploit due to base64 obfuscation. The flaw affects Tomcat versions 9, 10, and 11, and Apache has advised upgrading to patched versions or disabling partial PUT support and enforcing stricter file handling. Security researchers warn that this vulnerability may signal further RCE exploits related to Tomcat’s handling of partial PUT requests. CTIX analysts urge any administrators running Apache Tomcat ensure that their servers are patched and secure to prevent future exploitation.