CVE-2026-16723: Critical RCE in Fastjson 1.x, Active Exploitation in Spring Boot Environments

Introduction

On July 21, 2026, Alibaba released an advisory for CVE-2026-16723, a critical (CVSS 9.0) remote code execution (RCE) vulnerability affecting the Fastjson 1.x Java library. Discovered by researcher Kirill Firsov of FearsOff Cybersecurity, the flaw allows an unauthenticated attacker to take control of the Java process by simply sending a malicious JSON request. The following day, ThreatBook recorded the first active exploitation attempts, later confirmed by Imperva. The vulnerability exclusively affects Spring Boot applications packaged as executable fat‑JARs where SafeMode has been left disabled (the default condition). As of July 25, the latest available update, no patch had been released for the 1.x branch, making mitigations essential.

Technical Analysis

The vulnerability resides in the deserialization mechanism based on the @type key. Even with AutoType disabled, a carefully crafted payload containing @type triggers a resource probe that, in the context of a Spring Boot fat‑JAR, retrieves attacker‑controlled bytecode via a nested JAR path. On modern JDKs, the exploit leverages the /proc/self/fd virtual filesystem to bypass restrictions and obtain a reference to a remote JAR, without requiring any pre‑existing gadgets in the classpath.

The only necessary condition is that the server exposes an endpoint that parses JSON through methods such as JSON.parse or parseObject(String). The malicious request can also be injected within nested Object or Map fields, making any protection based on superficial schema inspection ineffective. The attack is pre‑authentication, requires no credentials, and leads to arbitrary code execution with the privileges of the Java process.

Impact

Compromise is total: from data exfiltration to malware installation, up to lateral movement towards other internal systems. The first campaigns, observed starting on July 22, predominantly targeted the financial, healthcare, retail, and IT sectors in the United States, with minor incidents in Singapore and Canada. No data on confirmed compromises has yet been shared, but the ease of exploitation makes the risk concrete for any organization using the affected versions.

On July 23, the CISA‑ADP program assessed exploitation as “absent,” thus the CVE was not included in the Known Exploited Vulnerabilities catalog. However, this assessment contrasts with evidence gathered by security vendors, underscoring a rapidly evolving landscape.

Mitigation

Given that no fix is planned for the 1.x branch – version 1.2.83, the latest stable until yesterday, now falls within the vulnerable range – one of the following countermeasures must be adopted immediately:

• Enable SafeMode by adding the JVM flag -Dfastjson.parser.safeMode=true. This thoroughly disables the @type functionality, preventing the exploit trigger.
• Replace the dependency with the restricted artifact com.alibaba:fastjson:1.2.83_noneautotype, which inhibits resource lookup while maintaining compatibility with existing code.
• Plan a migration to Fastjson2, which does not employ the same resource probe mechanism and is not affected by the vulnerability.

Additional detection and hardening actions:

• Enumerate all occurrences of Fastjson (including transitive dependencies) across development, test, and production environments.
• Monitor logs for @type associated with nested JAR paths, anomalous network connections, child process spawns, or suspicious filesystem writes (e.g., web shells).
• Ensure that parsing methods do not accept JSON from untrusted sources, even when seemingly bound to fixed classes.

FAQ

Which Fastjson versions are exactly vulnerable?
Releases from 1.2.68 through 1.2.83 are at risk, but only if the application is an executable Spring Boot fat‑JAR and SafeMode has not been enabled (default). Plain JARs, generic uber‑JARs, and WAR deployments on Tomcat/Jetty do not present the necessary condition for exploitation.

Is my application at risk even with AutoType disabled?
Yes. The attack does not leverage the AutoType feature, but rather an internal resource probe triggered by a crafted @type. Disabling AutoType is not sufficient to block the payload, nor is the absence of gadgets in the classpath.

I cannot migrate to Fastjson2 right away: what should I do now?
The two immediate mitigations – enabling SafeMode or adopting the 1.2.83_noneautotype artifact – provide complete protection without requiring code changes. Both are backward‑compatible and can be applied straightaway while planning the migration to Fastjson2.