How severe is CVE-2016-9877?

CVE-2016-9877 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2016-9877 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2016-9877?

CVE-2016-9877 primarily affects Broadcom Rabbitmq Server. In total, 76 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2016-9877?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2016-9877 published?

CVE-2016-9877 was published on 2016-12-29 and last updated on 2026-06-17.

CVE-2016-9877

CVE-2016-9877 is a critical-severity vulnerability in Broadcom Rabbitmq Server with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-284.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 1% (71st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-284
Affected product: Broadcom Rabbitmq Server
Published: 2016-12-29
Last modified: 2026-06-17

Description

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

Frequently asked questions

What is CVE-2016-9877?: An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
How severe is CVE-2016-9877?: CVE-2016-9877 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2016-9877 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-9877?: CVE-2016-9877 primarily affects Broadcom Rabbitmq Server. In total, 76 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2016-9877?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2016-9877 published?: CVE-2016-9877 was published on 2016-12-29 and last updated on 2026-06-17.

References

Affected products (76)

cpe:2.3:a:broadcom:rabbitmq_server:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.2.4:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.3.5:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.4.2:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.4.3:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.4.4:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.5.0:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.5.1:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.5.2:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.5.3:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:3.5.6:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:rabbitmq:3.5.4:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:rabbitmq:3.5.5:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:rabbitmq:3.5.7:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:rabbitmq:3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:rabbitmq:3.6.1:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:rabbitmq:3.6.2:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:rabbitmq:3.6.3:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:rabbitmq:3.6.4:*:*:*:*:*:*:*

More vulnerabilities in Broadcom Rabbitmq Server

CVE-2026-57215 — High (CVSS 8.8): RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign…
CVE-2026-44838 — High (CVSS 8.1): RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level…
CVE-2021-22117 — High (CVSS 7.8): RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing…
CVE-2017-4966 — High (CVSS 7.8): An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions…
CVE-2026-57212 — High (CVSS 7.7): RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP…
CVE-2026-57220 — High (CVSS 7.5): RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the…

All CVEs affecting Broadcom Rabbitmq Server →

Other CWE-284 (Improper Access Control) vulnerabilities

CVE-2026-83944 — Critical (CVSS 10.0): Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-20192 — Critical (CVSS 10.0): As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine…
CVE-2026-87230 — Critical (CVSS 10.0): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The…
CVE-2026-54745 — Critical (CVSS 10.0): Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0,…
CVE-2026-18886 — Critical (CVSS 10.0): ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform.…
CVE-2026-76607 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.

Browse all CWE-284 (Improper Access Control) vulnerabilities →