Fastjson RCE (≤ 1.2.83) — Active Exploitation Detected (ThreatBook XVE-2026-39684)
Fastjson RCE (≤ 1.2.83) (TL-2026-1609), also tracked as XVE-2026-39684, is a high-severity software vulnerability, first published 2026-07-22. It has no confirmed attribution, affects Alibaba Fastjson (com.alibaba:fastjson), maps to 21 MITRE ATT&CK techniques (T1005, T1046, T1059), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1609
- Threat ID
- TL-2026-1609
- Also known as
- XVE-2026-39684
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, finance, government administration, ecommerce, education, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Fastjson RCE (≤ 1.2.83)
Malware and tooling: AndroxGh0st, attacker/Gen.java, fastjson-jsontype-rce-lab, fjdetect.py / fjscan_static.py / fjscan_probe.py
A remote code execution vulnerability in Alibaba Fastjson versions ≤ 1.2.83 allows unauthenticated attackers to execute arbitrary code via specially crafted JSON containing @type payload signatures (jar:file:. / jar:http:..) that trigger remote-class-loading through Spring Boot's LaunchedURLClassLoader. ThreatBook TDP confirmed active in-the-wild exploitation and public PoC availability, with detection deployed since July 20, 2026. No CVE has been assigned; ThreatBook tracks the flaw as XVE-2026-39684.
How Fastjson RCE (≤ 1.2.83) works
Fastjson (com.alibaba:fastjson) is a widely-embedded high-performance JSON library for Java, historically plagued by unsafe deserialization behavior in its @type/autoType handling. The 1.x branch, unmaintained since the 1.2.83 release (May 23, 2022), remains deployed across a large population of legacy Java web applications, Spring Boot microservices, and enterprise middleware.
ThreatBook Threat Detection Platform (TDP) captured live in-the-wild traffic exploiting Fastjson deployments at or below version 1.2.83 using two distinct payload signatures observed in the `@type` field: `@type":"jar:file:.` and `@type":"jar:http:..`. Analysis of the captured traffic confirmed exploitation via the `jar:http` variant against a Spring Boot FatJar application running on JDK 8, which triggers a remote JAR fetch (creating an SSRF condition) and forces the JVM's class loader to resolve and initialize an attacker-hosted class.
This technique aligns with a documented exploitation class publicly described for the fastjson 1.2.66–1.2.83 @JSONType remote-class-load RCE: the parser's `checkAutoType`/resource-probing logic performs `getResourceAsStream(typeName.replace('.','/') + ".class")`, which can be pointed at a remote JAR URL. Because the attacker-controlled class's static initializer (`<clinit>`) executes during the `@type` type-probe step — before Fastjson ever attempts to cast the resulting object to a bound DTO type — restricting the target Java type ("binding") does NOT mitigate the attack. Under JDK 8/Spring Boot FatJar conditions, the `jar:http` probe alone is sufficient for immediate code execution. Under newer JDK 17+ Linux targets, a two-step chain using `/proc/self/fd/N` can reopen a JAR cached by an initial `jar:http` probe as a `jar:file:` reference, achieving the same class-loading primitive even when AutoType is nominally disabled, so long as SafeMode and IgnoreAutoType are not enforced and outbound egress is permitted.
This vulnerability class is a direct descendant of the well-documented AutoType-bypass lineage in Fastjson, most notably CVE-2022-25845 (CVSS 3.1 base 8.1, some sources 9.8), in which Fastjson's `ThrowableDeserializer` was found to bypass the AutoType blacklist entirely for any class extending `java.lang.Throwable`, permitting arbitrary class instantiation regardless of the checkAutoType() blacklist result. Unlike CVE-2022-25845's Throwable-extension bypass, however, the XVE-2026-39684 activity ThreatBook captured relies on the remote-JAR/class-loader primitive rather than a Throwable-subclass gadget, and does not require a pre-existing exploitable gadget chain in the target's classpath (a constraint that historically limited real-world Fastjson RCE, since JFrog's CVE-2022-25845 research found no reliable, widely-applicable gadget chain beyond a low-impact Selenium WebDriverException data-leak primitive).
Exploitation requires no authentication, no user interaction, and no bypass of an additional security control beyond SafeMode being left disabled (the library's default posture on legacy 1.x deployments). Because Fastjson underpins countless internal APIs, message brokers, and microservice request/response pipelines, a successful hit typically yields immediate RCE in the context of the vulnerable JVM process, enabling webshell deployment, credential/secret harvesting from the host and any adjacent cloud metadata service, and lateral pivoting.
Separately, and providing broader threat-landscape context, botnets such as Androxgh0st have for several years incorporated Fastjson/Fastjson-adjacent JNDI-injection techniques (alongside Apache Shiro, jackson-databind, and Struts OGNL exploitation) into automated internet-wide scan-and-exploit operations targeting exposed Java services for credential harvesting and C2 logger hosting, illustrating the operational appetite for this vulnerability class among opportunistic, mass-exploitation threat actors even absent a named actor for this specific ThreatBook capture.
No CVE identifier has been assigned to the specific XVE-2026-39684 activity as of this writing, and ThreatBook's advisory does not publish a CVSS score; based on the unauthenticated, no-interaction, full-RCE impact profile consistent with the historical AutoType-bypass CVE-2022-25845 baseline, this threat is scored HIGH/CRITICAL-adjacent pending formal CVE/CVSS assignment.
MITRE ATT&CK techniques used in TL-2026-1609
Collection
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1610 Deploy Container
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Impact
Persistence
T1505 Server Software Component
Credential Access
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities
Reconnaissance
Affected products and versions in Fastjson RCE (≤ 1.2.83)
- Alibaba — Fastjson (com.alibaba:fastjson)
Vulnerable versions: 1.2.83 and all earlier 1.x releases; 1.2.66-1.2.83 (@JSONType remote-class-load variant)
Fixed in: Fastjson 2.x (full remediation); 1.2.83 with SafeMode/IgnoreAutoType enabled (interim mitigation only) - VMware / Spring — Spring Boot (FatJar deployment model)
Vulnerable versions: Any Spring Boot FatJar application on JDK 8 embedding vulnerable Fastjson versions and exposing untrusted JSON parsing
Fixed in: N/A — mitigation is at the Fastjson/JVM configuration layer, not the Spring Boot layer
Remediation for Fastjson RCE (≤ 1.2.83)
Patches
- Upgrade com.alibaba:fastjson to 1.2.83 or later as an interim step (already the ceiling for this vulnerability class; full remediation requires 2.x)
- Apply vendor SafeMode configuration where an immediate version upgrade is not feasible
Immediate actions
- Enable Fastjson SafeMode via code: ParserConfig.getGlobalInstance().setSafeMode(true)
- Enable SafeMode via JVM parameter: -Dfastjson.parser.safeMode=true
- Enable SafeMode via configuration file property: fastjson.parser.safeMode=true
- Deploy WAF/IPS signatures blocking POST bodies containing the @type payload strings jar:file:. and jar:http:..
- Restrict outbound egress from Java application servers to prevent remote JAR fetch (SSRF) and JNDI/RMI/LDAP callbacks
- Audit any custom AutoTypeCheckHandler implementations for gaps in the deny-list
Workarounds
- Set IgnoreAutoType alongside SafeMode to close residual autoType handling paths
- Front vulnerable services with a reverse proxy performing deep JSON body inspection for @type fields referencing jar: URIs
Longer-term hardening
- Migrate to Fastjson 2.x, which redesigns the type-handling model away from the legacy autoType/@type deserialization pattern
- Deploy RASP or Java agent-based instrumentation to detect anomalous class loading and JNDI lookups at runtime
- Inventory all internal services embedding com.alibaba:fastjson (including transitive dependencies) via SCA tooling
- Enforce network segmentation so that Java application tiers cannot reach arbitrary external hosts on HTTP/RMI/LDAP ports
Weaknesses (CWE) in Fastjson RCE (≤ 1.2.83)
CWE-502, CWE-918, CWE-494
Timeline of Fastjson RCE (≤ 1.2.83)
- Fastjson maintainers release version 1.2.83, the final patch of the 1.x branch, addressing the AutoType-bypass class of issues including CVE-2022-25845.
- CVE-2022-25845 publicly disclosed and analyzed by JFrog, documenting the ThrowableDeserializer AutoType-blacklist bypass affecting Fastjson ≤1.2.80.
- CISA and FBI release a joint advisory detailing known IOCs and TTPs for the Androxgh0st botnet, which has incorporated Fastjson/JNDI-adjacent exploitation into its scan-and-exploit toolkit.
- Public defensive research/lab (fastjson-jsontype-rce-lab) documents the @JSONType remote-class-load RCE technique affecting Fastjson 1.2.66-1.2.83 via jar:http/jar:file probes and Spring Boot's LaunchedURLClassLoader, confirming binding is not a sufficient mitigation.
- ThreatBook TDP detection rule S3100181015 (rule version 20260720000000) goes live, targeting the observed jar:file:. and jar:http:.. @type payload signatures.
- Security research entity FearsOff discloses the fastjson @JSONType remote-class-load RCE technique, describing both the legacy JDK 8 direct-class route and the modern JDK 17+ /proc/self/fd continuation chain that the fastjson-jsontype-rce-lab PoC independently reconstructs.
- TL-Intel-Harness ingests the ThreatBook advisory via RSS hunt phase and opens threat record TL-2026-1609 for research.
- ThreatBook publishes the public advisory confirming active in-the-wild exploitation of Fastjson ≤1.2.83 under tracking ID XVE-2026-39684, with public PoC availability and no CVE yet assigned.
Sources cited for Fastjson RCE (≤ 1.2.83)
- Fastjson RCE (≤ 1.2.83): Active Exploitation Detected
- CVE-2022-25845: Analyzing the Fastjson Auto-Type Bypass RCE Vulnerability
- High-Severity RCE Vulnerability Reported in Popular Fastjson Library
- fastjson-jsontype-rce-lab: @JSONType remote-class-load RCE (1.2.66-1.2.83)
- CVE-2022-25845 - Fastjson RCE vulnerability analysis
- CVE-2022-25845: Alibaba Fastjson Remote Code Execution Vulnerability
- Deep Dive into Fastjson Deserialization Vulnerabilities: From Principles to Practical Defense
- Fastjson RCE: JNDI Injection via @type Deserialization
- CISA and FBI Release Known IOCs Associated with Androxgh0st Malware
- Imperva Uncovers New IoCs for AndroxGh0st Botnet
Threats related to Fastjson RCE (≤ 1.2.83)
- Fastjson 1.x RCE (CVE-2026-16723) — Gadget-Free Deserialization Bypass Actively Exploited in Spring Boot Fat-JAR Deployments
- CVE-2026-20230: Active Exploitation of Cisco Unified CM WebDialer SSRF Flaw Leading to Root-Level Compromise
- CVE-2026-20251: Splunk Secure Gateway jsonpickle Deserialization RCE with Public PoC
- CVE-2026-45659: Microsoft SharePoint Deserialization RCE Added to CISA KEV Despite 'Exploitation Less Likely' Rating
- Pwn2Own Berlin 2026 Day Three: Zero-Days Demonstrated in VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Linux, and Anthropic Claude Code
- Fastjson 1.2.x Gadget-Free Remote Code Execution via @JSONType Remote Class Load (Versions 1.2.68-1.2.83)
Detection coverage for TL-2026-1609
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1609 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.