A critical flaw in Fastjson, a widely used Java data-handling library from Alibaba, lets an attacker take
full control of a server by sending it one specially crafted message, with no login and no user action
needed. It affects Fastjson versions 1.2.68 to 1.2.83 in common Spring Boot applications, there is no
fixed 1.x version, and security firms report attackers already probing for it. Turn on Fastjson SafeMode
now and plan to move to Fastjson2, which is not affected.
1. Vulnerability Details
CVE ID – CVE-2026-16723
CVSS SCORE – 9.0
EXPLOIT STATUS – Reported active exploitation (ThreatBook, Imperva). No fixed 1.x version. CISA-ADP marks exploitation none as of 23 July 2026.
The flaw sits in Fastjson’s checkAutoType type-resolution path. Before deciding whether a class is allowed, Fastjson calls getResourceAsStream on the attacker-controlled @type value, which gives a blind server-side request forgery even with AutoType off. Fastjson then treats a @JSONType annotation on the fetched class as a trust signal, loads it, and runs its static initialiser. On JDK 8 a jar:http URL loads the class directly; on JDK 9 and later a /proc/self/fd reference to the JVM’s cached JAR bypasses the class-name check, carrying execution to modern JDKs through the Spring Boot fat-jar LaunchedURLClassLoader. No CVSS vector or formal CWE was published in the sources.
2. Affected Products & Fixed Versions
| Component | Vulnerable Versions | Fixed Build |
| Fastjson 1.x (Spring Boot executable fat-jar, SafeMode off, AutoType off) | 1.2.68 to 1.2.83 | No fixed 1.x release. Enable SafeMode or use 1.2.83_noneautotype. |
| Fastjson2 (all versions) | Not affected | Migrate to the current Fastjson2 release. |
3. Observed Activity
Exploitation needs no authentication, no user interaction, and no classpath gadget. It requires only a network-reachable path that feeds attacker-controlled JSON to an affected parser in a Spring Boot fat-jar with SafeMode disabled. Verified on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21.
- Disclosure (21 July 2026) Alibaba published a security advisory after Kirill Firsov of FearsOff reported the flaw. The library maintainers assigned a CVSS score of 9.0 and released no fixed 1.x version.
- ThreatBook (22 July 2026) ThreatBook reported capturing in-the-wild exploitation and had added detection two days earlier. It reproduced full code execution on a Spring Boot fat-jar on JDK 8, while an embedded Tomcat test produced only a remote JAR fetch or server-side request forgery.
- Imperva telemetry (24 July 2026) Imperva reported exploit requests against financial services, healthcare, computing, and retail organisations, almost entirely US-based with smaller volumes in Singapore and Canada. Browser-impersonator user agents made up most requests; Ruby and Go tools accounted for about 30 per cent.
- Confidence caveat No vendor published attack counts, named victims, or confirmed compromises, so the reports show observed exploit activity rather than proven code execution. A CISA-ADP assessment on 23 July marked exploitation none, and the CVE was absent from CISA’s Known Exploited Vulnerabilities catalogue as of 25 July.
4. Recommendations
- Inventory all direct and transitive Fastjson dependencies, and identify Spring Boot fat-jar applications running 1.2.68 to 1.2.83 with SafeMode disabled.
- Enable SafeMode now on affected applications: set -Dfastjson.parser.safeMode=true, or ParserConfig.getGlobalInstance().setSafeMode(true), or fastjson.parser.safeMode=true infastjson.properties.
- Where feasible, switch to the restricted build com.alibaba:fastjson:1.2.83_noneautotype, and plan migration to Fastjson2, which is not affected.
- Block requests at WAF and IPS that contain the exact strings @type”:”jar:file:. or @type”:”jar:http:.., and hunt logs for suspicious @type values and nested jar: URLs.
- Inspect affected hosts for unexpected child processes, outbound connections, file changes, and web shells, and treat any as a possible compromise since no vendor patch exists.
5. Sources
- https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83
- https://fearsoff.org/research/fastjson-1-2-83-rce
- https://threatbook.io/blog/fastjson-rce-1.2.83-active-exploitation-detected-detection-mitigation
- https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.
