Fastjson RCE (≤ 1.2.83) — Active Exploitation Detected (ThreatBook XVE-2026-39684) — Threadlinqs Intelligence
As of 2026-07-22, Fastjson RCE (≤ 1.2.83) — Active Exploitation Detected (ThreatBook XVE-2026-39684) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1609 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
A remote code execution vulnerability in Alibaba Fastjson versions ≤ 1.2.83 allows unauthenticated attackers to execute arbitrary code via specially crafted JSON containing @type payload signatures
Fastjson (com.alibaba:fastjson) is a widely-embedded high-performance JSON library for Java, historically plagued by unsafe deserialization behavior in its @type/autoType handling. The 1.x branch, unmaintained since the 1.2.83 release (May 23, 2022), remains deployed across a large population of legacy Java web applications, Spring Boot microservices, and enterprise middleware.
ThreatBook Threat Detection Platform (TDP) captured live in-the-wild traffic exploiting Fastjson deployments at or below version 1.2.83 using two distinct payload signatures observed in the `@type` field: `@type":"jar:file:.` and `@type":"jar:http:..`. Analysis of the captured traffic confirmed exploitation via the `jar:http` variant against a Spring Boot FatJar application running on JDK 8, which triggers a remote JAR fetch (creating an SSRF condition) and forces the JVM's class loader to resolve and initialize an attacker-hosted class.
This technique aligns with a documented exploitation class publicly described for the fastjson 1.2.66–1.2.83 @JSONType remote-class-load RCE: the parser's `checkAutoType`/resource-probing logic performs `getResourceAsStream(typeName.replace('.','/') + ".class")`, which can be pointed at a remote JAR URL. Because the attacker-controlled class's static initializer (`<clinit>`) executes during the `@type` type-probe step — before Fastjson ever attempts to cast the resulting object to a bound DTO type — restricting the target Java type ("binding") does NOT mitigate the attack. Under JDK 8/Spring Boot FatJar conditions, the `jar:http` probe alone is sufficient for immediate code execution. Under newer JDK 17+ Linux targets, a two-step chain using `/proc/self/fd/N` can reopen a JAR cached by an initial `jar:http` probe as a `jar:file:` reference, achieving the same class-loading primitive even when AutoType is nominally disabled, so long as SafeMode and IgnoreAutoType are not enforced and outbound egress is permitted.
This vulnerability class is a direct descendant of the well-documented AutoType-bypass lineage in Fastjson, most notably CVE-2022-25845 (CVSS 3.1 base 8.1, some sources 9.8), in which Fastjson's `ThrowableDeserializer` was found to bypass the AutoType blacklist entirely for any class extending `java.lang.Throwable`, permitting arbitrary class instantiation regardless of the checkAutoType() blacklist result. Unlike CVE-2022-25845's Throwable-extension bypass, however, the XVE-2026-39684 activity ThreatBook captured relies on the remote-JAR/class-loader primitive rather than a Throwable-subclass gadget, and does not require a pre-existing exploitable gadget chain in the target's classpath (a constraint that historically limited real-world Fastjson RCE, since JFrog's CVE-2022-25845 research found no reliable, widely-applicable gadget chain beyond a low-impact Selenium WebDriverException data-leak primitive).
Exploitation requires no authentication, no user interaction, and no bypass of an additional security control beyond SafeMode being left disabled (the library's default posture on legacy 1.x deployments). Because Fastjson underpins countless internal APIs, message brokers, and microservice request/response pipelines, a successful hit typically yields immediate RCE in the context of the vulnerable JVM process, enabling webshell deployment, credential/secret harvesting from the host and any adjacent cloud metadata service, and lateral pivoting.
Separately, and providing broader threat-landscape context, botnets such as Androxgh0st have for several years incorporated Fastjson/Fastjson-adjacent JNDI-injection techniques (alongside Apache Shiro, jackson-databind, and Struts OGNL exploitation) into automated internet-wide scan-and-exploit operations targeting exposed Java services for credential harvesting and C2 logger hosting, illustrating the operational appetite for this vulnerability class among opportunistic, mass-exploitation threat actors even absent a named actor for this specific ThreatBook capture.
N
Weaknesses (CWE)
CWE-502, CWE-918, CWE-494
Target sectors: technology, finance, government administration, ecommerce, education, software-development
Target regions: Global
Detections & IOCs
As of 2026-07-22, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1595, T1587, T1583, T1190, T1203, T1059, T1610, T1505, T1068, T1140