Fastjson 1.x RCE Vulnerability Actively Exploited Despite No Official Patch
Attackers are actively exploiting a critical Fastjson 1.x RCE vulnerability (CVE-2026-16723) in Java applications, particularly those using Spring Boot, with no official patch currently available.
Security researchers and firms ThreatBook and Imperva have reported active exploitation of a critical remote code execution (RCE) vulnerability within Alibaba's Fastjson 1.x library, a popular JSON parser for Java applications. The flaw, tracked as CVE-2026-16723, allows unauthenticated attackers to execute arbitrary code with the privileges of the Java process, posing a significant risk to applications that rely on vulnerable versions of the library.
The vulnerability specifically affects Fastjson versions 1.2.68 through 1.2.83 when used in conjunction with Spring Boot executable fat-JARs. Crucially, the exploit chain does not require AutoType to be enabled or any specific classpath gadgets, making it relatively straightforward to leverage. The default configuration of Fastjson, where SafeMode is disabled, is also a prerequisite for successful exploitation. The severity of this flaw is underscored by its CVSS score of 9.0.
As of July 25, 2026, Alibaba had not released a patched version of Fastjson 1.x. The recommended long-term solution is to migrate to Fastjson2, which is not affected by this vulnerability. For organizations unable to migrate immediately, Alibaba suggests enabling SafeMode by setting the Java system property -Dfastjson.parser.safeMode=true or by using the specific build com.alibaba:fastjson:1.2.83_noneautotype.
The vulnerability was disclosed responsibly by Kirill Firsov of FearsOff Cybersecurity, leading to an advisory from Alibaba on July 21. Firsov's technical analysis revealed that the flaw stems from Fastjson's type-resolution mechanism. An attacker-controlled @type value in a JSON payload can be manipulated to trigger a class-resource lookup. In a compatible Spring Boot fat-JAR environment, this can lead to fetching attacker-controlled bytecode, which is then trusted and loaded due to an @JSONType annotation within the resource.
Exploitation is primarily observed in Spring Boot applications packaged as executable fat-JARs. Alibaba has clarified that plain non-fat JARs, generic uber-JARs, and deployments within Tomcat or Jetty WAR files are not susceptible to this specific exploit chain. Common entry points for the attack include JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class) methods when processing untrusted JSON input.
Threat intelligence indicates that exploitation is occurring in the wild. ThreatBook reported capturing exploit activity shortly after releasing detection capabilities, while Imperva observed attacks targeting organizations across financial services, healthcare, computing, and retail sectors, primarily in the United States, with some activity noted in Singapore and Canada. The nature of the observed requests suggests a mix of browser impersonators and custom tools written in Ruby and Go.
Despite the reported in-the-wild exploitation, the vulnerability has not yet been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and a CISA-ADP assessment marked exploitation as 'none' as of July 23. The reasons for this discrepancy remain unclear. Organizations are urged to inventory their Fastjson dependencies, monitor for suspicious activity such as unusual @type values in JSON payloads, unexpected outbound network connections, and the execution of unauthorized child processes.
This incident highlights the ongoing challenges in securing the Java ecosystem, particularly with widely used libraries like Fastjson. The lack of an immediate patch for the 1.x branch, coupled with active exploitation, places a significant burden on developers and security teams to implement workarounds and plan for timely migration to more secure versions.