# Critical Fastjson RCE Under Active Exploitation: Alibaba's Java Library Vulnerable Security firms **ThreatBook** and **Imperva** have issued warnings about active exploitation targeting a critical vulnerability in **Fastjson**, **Alibaba**'s widely used JSON library for Java. The flaw, identified as **CVE-2026-16723**, enables attackers to execute arbitrary code without authentication in affected **Spring Boot** applications, operating with the privileges of the Java process. ## The Vulnerability: CVE-2026-16723 **CVE-2026-16723** carries a severe **Alibaba**-assigned CVSS score of 9.0. The confirmed exploit chain impacts **Fastjson** versions 1.2.68 through 1.2.83. It necessitates a **Spring Boot** executable fat-JAR, a network-accessible path that feeds attacker-controlled JSON to a vulnerable parser, and the default disabled state of **SafeMode**. Notably, the **AutoType** feature can remain disabled, and no classpath gadget is required for successful exploitation. ## Mitigation and Fixes As of July 25, **Alibaba** had not yet released a patched version for the **Fastjson 1.x** branch. Organizations unable to immediately migrate to **Fastjson2**—which **Alibaba** recommends as the long-term solution—should implement interim mitigations: * Enable **SafeMode** using the JVM argument `-Dfastjson.parser.safeMode=true`. * Utilize `com.alibaba:fastjson:1.2.83_noneautotype`, a restricted build. **Alibaba** published its advisory on July 21, following responsible disclosure by **FearsOff Cybersecurity**. The maintainers verified the exploit chain on **Spring Boot** 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21. ## Technical Deep Dive **Firsov** from **FearsOff Cybersecurity** traced the issue to **Fastjson**'s type-resolution path. An attacker can manipulate an `@type` value, turning it into a class-resource lookup. Within a compatible **Spring Boot** fat-JAR, a specially crafted nested JAR path can then fetch attacker-controlled bytecode. An `@JSONType` annotation within that resource can subsequently be treated as a trust signal, allowing the class to bypass **Fastjson**'s type checks and load. **Firsov**'s technical analysis also details an alternative exploit path for newer JDK versions that involves downloading a remote JAR and referencing it via `/proc/self/fd`.  ## Exploit Conditions and Unaffected Deployments The exploit hinges on the **Spring Boot** executable fat-JAR loader. Deployments using plain non-fat JARs, generic uber-JARs, or **Tomcat**/**Jetty** WAR are listed as unaffected. Reachable entry points for the exploit include `JSON.parse`, `JSON.parseObject(String)`, and `JSON.parseObject(String, Class)`. Binding input to a fixed class is not sufficient if an object contains an `Object` or `Map` field where the malicious payload can be nested. ## Active Exploitation in the Wild **ThreatBook** reported capturing in-the-wild exploitation on July 22, just two days after adding detection support. Their laboratory tests confirmed full code execution in a **Spring Boot** fat-JAR on JDK 8, though embedded **Tomcat** tests only yielded remote JAR fetching or server-side request forgery. **Imperva** observed attack activity against organizations in financial services, healthcare, computing, retail, and other sectors, predominantly in the United States, with smaller volumes in Singapore and Canada. They noted that browser impersonators generated most requests, while **Ruby** and **Go** tools accounted for approximately 30% of the attack volume.  While both vendors reported observed exploit activity, they did not publish attack counts, raw requests, execution evidence, named victims, or confirmed compromises. ## CISA's Stance and Patching Status A July 23 **CISA-ADP** assessment surprisingly marked exploitation as `none`. Furthermore, the flaw was absent from **CISA**'s current Known Exploited Vulnerabilities catalog as of July 25, creating a discrepancy with the security firms' reports. As of the same date, no patched **Fastjson 1.x** artifact was found in the project's **GitHub** tags or **Maven Central** repository. Version 1.2.83 remains the latest standard 1.x release, with `1.2.83_noneautotype` available as a restricted build. ## Recommendations for Organizations Organizations are urged to: * Inventory all direct and transitive **Fastjson** dependencies. * Inspect affected systems for suspicious `@type` values, nested JAR URLs, unexpected outbound connections, child processes, file changes, and web shells. * Prioritize migration to **Fastjson2**, which is not affected by this vulnerability due to its redesigned resource-probing and annotation-based trust paths. It's worth noting that **Fastjson 1.2.83** was previously recommended by **Alibaba** as an upgrade to address a separate **AutoType** bypass disclosed in 2022. This final 1.x release now ironically falls within the vulnerable range for **CVE-2026-16723**.