Security firms ThreatBook and Imperva confirm active exploitation of CVE-2026-16723, a critical remote code execution vulnerability in Fastjson 1.x (Alibaba’s JSON library for Java). As of July 30, 2026, no patched Fastjson 1.x version exists. Alibaba’s official guidance: enable SafeMode immediately or migrate to Fastjson2.

What Happened

On July 21, 2026, Alibaba published a security advisory following responsible disclosure by Kirill Firsov of FearsOff Cybersecurity. The vulnerability affects Fastjson 1.2.68 through 1.2.83 — including 1.2.83, which was previously recommended as the “final safe” 1.x release. The flaw carries a CVSS score of 9.0 (Alibaba-assigned) and requires no AutoType enablement and no classpath gadget.

ThreatBook detected in-the-wild exploitation on July 22. Imperva reports targeting across financial services, healthcare, computing, and retail sectors, primarily in the United States, with smaller volumes in Singapore and Canada. CISA-ADP marked exploitation as none as of July 23 — a discrepancy neither side has explained.

Vulnerability Details

Property	Value
CVE ID	CVE-2026-16723
Component	Fastjson 1.x (com.alibaba:fastjson)
Affected Versions	1.2.68 – 1.2.83 (inclusive)
Vulnerability Type	Deserialization / Type confusion leading to RCE
Attack Vector	Network — malicious JSON request to Spring Boot endpoint
Prerequisites	Spring Boot executable fat-JAR, SafeMode disabled (default)
AutoType Required	No
Classpath Gadget Required	No
CVSS (Alibaba)	9.0 Critical
Patch Status	No patched 1.x release (as of July 30, 2026)
Exploitation Status	Active, in-the-wild

Root Cause Analysis

Firsov traced the issue to Fastjson’s type-resolution path. An attacker-controlled @type value triggers a class-resource lookup. In a compatible Spring Boot executable fat-JAR, a crafted nested JAR path can fetch attacker-controlled bytecode. An @JSONType annotation in that resource is then treated as a trust signal, allowing the class to pass Fastjson’s type checks and load.

A secondary path on newer JDKs downloads a remote JAR and references it through /proc/self/fd.

The exploit depends specifically on the Spring Boot executable fat-JAR loader. Alibaba confirms:

• Plain non-fat JARs: Unaffected
• Generic uber-JARs: Unaffected
• Tomcat / Jetty WAR deployments: Unaffected

Reachable entry points include JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Binding input to a fixed class is not sufficient when an object contains an Object or Map field where the payload can be nested.

Impact Assessment

Any Spring Boot application (2.x, 3.x, 4.x) on JDK 8, 11, 17, or 21 that:

1. Uses Fastjson 1.2.68–1.2.83 as a direct or transitive dependency
2. Runs as an executable fat-JAR (spring-boot-maven-plugin or spring-boot-gradle-plugin)
3. Has fastjson.parser.safeMode at its default (false)
4. Exposes an endpoint accepting JSON input

... is vulnerable to unauthenticated RCE with the privileges of the Java process.

Mitigation & Remediation

Immediate Workarounds (Choose One)

Option 1: Enable SafeMode (no code change)

Or programmatically before any Fastjson call:

Option 2: Use the restricted 1.2.83 build

This build disables AutoType entirely. May break applications relying on @type polymorphism.

Long-Term Fix: Migrate to Fastjson2

Fastjson2 (com.alibaba.fastjson2) is not affected because it does not use the same resource-probing or annotation-based trust path. Alibaba lists migration as the permanent solution.

Migration steps:

1. Update dependency: com.alibaba:fastjson2 (latest)
2. Update imports: com.alibaba.fastjson2.*
3. Test serialization/deserialization paths — API is similar but not identical
4. Verify @JSONType and custom serializer behavior

Detection Guidance

Indicators of Compromise

Indicator	Detection Method
Suspicious @type values in JSON logs	Application log analysis (WAF, API gateway)
Nested JAR URLs in @type (e.g., jar:file:...!/...)	Request body inspection
Unexpected outbound connections from Java process	Network monitoring / EDR
Child processes spawned by Java (shell, cmd)	Process tree monitoring
File writes to webapp / temp directories	File integrity monitoring
Web shell artifacts (JSP, PHP, ASPX)	Malware scan / YARA

YARA Rule (Fastjson exploit pattern):

rule Fastjson_CVE_2026_16723_Exploit { meta: description = "Detects Fastjson 1.x RCE exploit patterns in JSON payloads" author = "FearsOff / Aiyu Blog" date = "2026-07-30" strings: $type_field = "@type" nocase $jar_protocol = "jar:" nocase $proc_self_fd = "/proc/self/fd" nocase $json_type_ann = "@JSONType" nocase $fastjson_class = "com.alibaba.fastjson" nocase condition: $type_field and ($jar_protocol or $proc_self_fd or $json_type_ann) and $fastjson_class }

Sigma Rule (Spring Boot app with vulnerable Fastjson dependency — inventory):

Frequently Asked Questions

Q: Is Fastjson 1.2.83 safe? It was the "final" 1.x release. A: No. 1.2.83 is explicitly in the affected range. The "final safe" guidance was superseded by this disclosure.

Q: Does enabling SafeMode break my application? A: SafeMode blocks AutoType and restricts deserialization to a safe class list. Applications using @type for polymorphism will break. Test in staging first.

Q: What about transitive dependencies? A: Run mvn dependency:tree | grep fastjson or gradle dependencies | grep fastjson. If any transitive dependency pulls 1.2.68–1.2.83, you are affected.

Q: Is Fastjson2 a drop-in replacement? A: Mostly, but not 100%. Package is com.alibaba.fastjson2. Some annotations (@JSONField, @JSONType) and serializer APIs differ. Budget 1–2 sprints for migration.

Q: Why did CISA-ADP mark exploitation as none while ThreatBook/Imperva report active exploitation? A: Unclear. ThreatBook captured exploit traffic (July 22). Imperva observed cross-sector targeting. CISA may require higher-confidence evidence of successful code execution (not just exploit attempts).

Key Takeaways

• No patch for Fastjson 1.x: Alibaba has not released 1.2.84. The 1.x line is effectively end-of-life for security.
• Spring Boot fat-JAR is the trigger: Only executable fat-JAR deployments are vulnerable. WAR/Tomcat/plain JAR are safe.
• No AutoType, no gadget needed: This bypasses all prior Fastjson mitigations. SafeMode is the only 1.x defense.
• Actively exploited: Financial services, healthcare, retail targeted. US primary geography.
• Migrate to Fastjson2: The only permanent fix. Budget the migration now.
• Inventory immediately: Scan all Spring Boot fat-JARs for Fastjson 1.x transitive dependencies.

---

Sources: Alibaba Advisory, FearsOff Technical Analysis, ThreatBook, Imperva, The Hacker News, NVD