Security researchers have uncovered a critical remote code execution flaw in Alibaba’s Fastjson 1.x library. Tracked as CVE-2026-16723, this vulnerability carries a CVSS score of 9.0 and is already under active exploitation in the wild. Attackers can execute code on affected Spring Boot applications with no authentication required.
Furthermore, Alibaba has not released a patched version for Fastjson 1.x as of July 25, 2026. This leaves countless Java applications exposed until defenders apply manual mitigations or migrate to Fastjson2.
What Happened: Critical Fastjson RCE Under Active Attack
Alibaba published its security advisory on July 21, 2026, following responsible disclosure by Kirill Firsov of FearsOff Cybersecurity. The vulnerability affects Fastjson versions 1.2.68 through 1.2.83. In affected Spring Boot executable fat-JAR deployments, a malicious JSON request can trigger full code execution.
ThreatBook and Imperva both confirmed active exploitation on July 22, 2026. Imperva reported attacks against financial services, healthcare, computing, and retail organizations. Most requests came from browser impersonators, with Ruby and Go tools making up about 30 percent of traffic. Attack volumes concentrated in the United States, with smaller campaigns in Singapore and Canada.
However, neither vendor published confirmed compromise evidence or named victims. Their reports document observed exploit attempts rather than proof of successful breaches. A July 23 CISA-ADP assessment nevertheless marked exploitation as none, creating an apparent mismatch with the vendor reports.
Technical Details of the Fastjson Vulnerability
The root cause lies in Fastjson’s type-resolution path. An attacker-controlled @type value can trigger a class-resource lookup. In a compatible Spring Boot fat-JAR, a crafted nested JAR path fetches attacker-controlled bytecode. An @JSONType annotation in that resource then acts as a trust signal, allowing the class to pass Fastjson’s type checks and load.
Consequently, the exploit works without enabling AutoType and without requiring a classpath gadget. This marks a significant shift from prior Fastjson vulnerabilities that typically depended on AutoType bypasses. Firsov also described a newer-JDK path that downloads a remote JAR and references it through /proc/self/fd.
Exploit Prerequisites
- Fastjson 1.2.68 through 1.2.83
- Spring Boot executable fat-JAR deployment
- Network-reachable path accepting attacker-controlled JSON
- SafeMode left at its disabled default
Reachable Entry Points
JSON.parse(String)JSON.parseObject(String)JSON.parseObject(String, Class)
Moreover, binding input to a fixed class is not sufficient protection. If an object contains an Object or Map field, the payload can nest inside those fields and still reach the parser.
Importantly, Alibaba verified the exploit chain on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21. Plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments are unaffected.
Business and Operational Impact
Fastjson is one of the most widely used JSON libraries in the Java ecosystem. Organizations running Spring Boot microservices with Fastjson 1.x face immediate risk. The impact spans several sectors:
- Financial services: Payment processing and trading platforms risk direct financial losses
- Healthcare: Protected health information exposure and HIPAA compliance violations
- Retail and e-commerce: Customer data theft and payment card compromise
- Computing and cloud: Infrastructure takeover and lateral movement
In addition, the lack of a patched 1.x version means organizations cannot simply upgrade to fix the flaw. Migration to Fastjson2 or application of manual mitigations is required. For large enterprises, this represents a significant operational burden.
Mitigation and Recommendations
Immediate Actions for Defenders
- Inventory dependencies: Scan all Java applications for direct and transitive Fastjson 1.x dependencies
- Enable SafeMode: Launch with
-Dfastjson.parser.safeMode=trueto block the exploit path - Use restricted build: Replace standard Fastjson with
com.alibaba:fastjson:1.2.83_noneautotype - Monitor for signs of compromise: Look for suspicious
@typevalues, nested JAR URLs, unexpected outbound connections, and child processes - Audit JSON endpoints: Review all endpoints that accept JSON from untrusted sources
Long-Term Migration
Alibaba recommends migrating to Fastjson2 as the permanent fix. Fastjson2 is not affected by CVE-2026-16723 because it does not use the same resource-probing or annotation-based trust path. Organizations should plan migration timelines based on risk appetite and application complexity.
Detection Guidance
Security teams should monitor for the following indicators of attempted or successful exploitation:
- Outbound connections to unexpected domains from Java processes
- Child processes spawned by the JVM
- New JAR files or class resources appearing in temp directories
- Web shells or reverse shells in application logs
Bottom line: CVE-2026-16723 is a critical unpatched RCE in Fastjson 1.x with confirmed exploitation in the wild. Enable SafeMode or migrate to Fastjson2 immediately.
Incident Summary
| CVE ID: | CVE-2026-16723 |
| CVSS Score: | 9.0 (Critical) |
| Affected Library: | Alibaba Fastjson 1.2.68 – 1.2.83 |
| Affected Deployments: | Spring Boot executable fat-JAR (JDK 8, 11, 17, 21) |
| Exploit Requirements: | No AutoType, no classpath gadget required |
| Disclosure Date: | July 21, 2026 |
| Active Exploitation Confirmed: | July 22, 2026 (ThreatBook, Imperva) |
| Patch Status: | No patched Fastjson 1.x version available as of July 25, 2026 |
| Recommended Fix: | Enable SafeMode or migrate to Fastjson2 |
References
- Alibaba Fastjson Security Advisory, “Remote Code Execution in fastjson 1.2.68–1.2.83,” July 21, 2026, GitHub Advisory, accessed July 25, 2026.
- ThreatBook, “Fastjson RCE 1.2.83 Active Exploitation Detected,” July 22, 2026, ThreatBook Blog, accessed July 25, 2026.
- Imperva, “Imperva Customers Protected Against CVE-2026-16723 Critical Fastjson 1.x Zero-Day RCE,” July 2026, Imperva Blog, accessed July 25, 2026.
- Kirill Firsov, FearsOff Cybersecurity, “Fastjson 1.2.83 RCE,” FearsOff Research, accessed July 25, 2026.
- CISA ADP Assessment, CVE-2026-16723, NVD, July 23, 2026, NVD Entry, accessed July 25, 2026.
- The Hacker News, “Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patch Available,” July 25, 2026, THN Article, accessed July 25, 2026.
