Critical Fastjson RCE Flaw CVE-2026-16723 Actively Exploited - No Patch Yet
Security researchers at ThreatBook and Imperva have confirmed in-the-wild exploitation of a critical remote code execution vulnerability in Fastjson, Alibaba's widely deployed Java JSON parsing library. Tracked as CVE-2026-16723 and assigned an Alibaba-derived CVSS score of 9.0, the flaw allows an unauthenticated attacker to execute arbitrary code on vulnerable Spring Boot applications simply by sending a crafted JSON payload. The vulnerability was responsibly disclosed by Kirill Firsov of FearsOff Cybersecurity on July 21 and, as of late July, no patched Fastjson 1.x release has been published.
The exploit chain is unusually potent because it requires neither AutoType to be enabled nor a classpath gadget, conditions that traditionally gated similar Fastjson attacks. According to Firsov's technical analysis, an attacker-controlled @type value triggers a class-resource lookup that, in a Spring Boot executable fat-JAR, resolves to a crafted nested JAR path containing attacker-supplied bytecode. An @JSONType annotation within that resource is then treated as a trust signal, bypassing Fastjson's type checks. Confirmed-affected versions span Fastjson 1.2.68 through 1.2.83, deployed as a Spring Boot fat-JAR with a network-reachable parser endpoint and SafeMode left at its disabled default. Alibaba verified the chain on Spring Boot 2.x, 3.x, and 4.x across JDK 8, 11, 17, and 21. Reachable entry points include JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Defenders can audit exposure by running a port scanner against publicly facing Spring Boot services and confirming TLS posture with an SSL/TLS checker.
ThreatBook added detection coverage on July 20 and reported capturing live exploitation two days later, though its lab reproduction on JDK 8 with embedded Tomcat yielded only a remote JAR fetch or SSRF rather than full code execution. Imperva observed targeted activity against organizations in financial services, healthcare, computing, and retail, concentrated in the United States with smaller volumes hitting Singapore and Canada. Most requests originated from browser-impersonating user agents, while Ruby and Go-based tooling accounted for roughly 30% of traffic. Neither vendor disclosed attack counts, raw payloads, named victims, or confirmed compromises, but the convergence of independent observations strongly indicates active, automated scanning.
Organizations unable to migrate immediately should enable SafeMode via the JVM flag -Dfastjson.parser.safeMode=true or pin to the com.alibaba:fastjson:1.2.83_noneautotype artifact. Alibaba's long-term recommendation is migration to Fastjson2. Plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments are not affected. Security teams should also review Fastjson import paths for indirect supply-chain exposure and use a WHOIS lookup to investigate any suspicious infrastructure surfaced in logs. With no official patch available, configuration hardening and exposure reduction remain the only effective controls.