July 26, 2026 — Cybersecurity experts are warning developers and organizations to take immediate action after attackers began exploiting a critical remote code execution (RCE) vulnerability in Fastjson 1.x, Alibaba’s popular JSON processing library for Java.
The vulnerability, identified as CVE-2026-16723, affects vulnerable Spring Boot applications and can allow attackers to execute arbitrary code without authentication. Although the flaw has a CVSS severity score of 9.0, Alibaba has not yet released an official security patch for the affected Fastjson 1.x versions.
Active Exploitation Reported by Security Researchers
Security companies ThreatBook and Imperva reported detecting attempts to exploit the vulnerability in real-world environments.
Researchers say attackers are targeting applications that use Fastjson versions 1.2.68 through 1.2.83 in Spring Boot executable fat-JAR deployments. If exploited successfully, malicious JSON requests can execute code with the same privileges as the affected Java application.
Unlike earlier Fastjson vulnerabilities, this exploit does not require AutoType to be enabled or additional classpath gadgets, making it easier for attackers to abuse under specific deployment conditions.
No Official Patch Available Yet
Alibaba acknowledged the security flaw in an advisory published on July 21 following responsible disclosure by cybersecurity researcher Kirill Firsov of FearsOff Cybersecurity.
As of July 25, no patched Fastjson 1.x release had been published.
Organizations that cannot immediately migrate are advised to:
- Enable SafeMode by adding the JVM option:
-Dfastjson.parser.safeMode=true
- Use the restricted Fastjson 1.2.83_noneautotype build.
- Plan migration to Fastjson2, which Alibaba recommends as the permanent solution.
How the Vulnerability Works
According to technical analysis, attackers can abuse Fastjson’s type resolution mechanism by injecting specially crafted @type values inside malicious JSON data.
When vulnerable Spring Boot fat-JAR applications process the request, Fastjson may load attacker-controlled resources and execute malicious bytecode.
Researchers confirmed successful testing on:
- Spring Boot 2.x
- Spring Boot 3.x
- Spring Boot 4.x
- JDK 8, 11, 17, and 21
Applications packaged as standard JARs, generic uber-JARs, or deployed as Tomcat and Jetty WAR files are reportedly not affected.
Multiple Industries Being Targeted
Imperva reported attack attempts against organizations operating in:
- Financial services
- Healthcare
- Computing and technology
- Retail
Most activity has been observed in the United States, with smaller numbers of attacks detected in Singapore and Canada.
However, security researchers emphasized that current reports confirm exploit attempts, not verified successful breaches or compromised organizations.
CISA Has Not Listed the Vulnerability as Exploited
Interestingly, the vulnerability has not been added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog.
Researchers noted this differs from reports describing observed exploitation activity, although no explanation has been provided for the discrepancy.
Security Recommendations
Until an official patch becomes available, security teams should:
- Identify all applications using Fastjson 1.x.
- Enable SafeMode wherever possible.
- Upgrade to the 1.2.83_noneautotype build if migration cannot occur immediately.
- Prioritize migration to Fastjson2.
- Monitor systems for suspicious @type values, unexpected outbound network connections, unknown child processes, file modifications, and potential web shells.
Because the vulnerability is already attracting attackers, organizations using vulnerable Fastjson deployments are encouraged to implement mitigation measures as soon as possible.
