# Fastjson RCE (≤ 1.2.83) — Active Exploitation Detected (ThreatBook XVE-2026-39684)

> A remote code execution vulnerability in Alibaba Fastjson versions ≤ 1.2.83 allows unauthenticated attackers to execute arbitrary code via specially crafted JSON containing @type payload signatures (jar:file:. / jar:http:..) that trigger remote-class-loading through Spring Boot's LaunchedURLClassLoader. ThreatBook TDP confirmed active in-the-wild exploitation and public PoC availability, with detection deployed since July 20, 2026. No CVE has been assigned; ThreatBook tracks the flaw as XVE-2026-39684.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1609
- **ID:** TL-2026-1609
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Fastjson (com.alibaba:fastjson) is a widely-embedded high-performance JSON library for Java, historically plagued by unsafe deserialization behavior in its @type/autoType handling. The 1.x branch, unmaintained since the 1.2.83 release (May 23, 2022), remains deployed across a large population of legacy Java web applications, Spring Boot microservices, and enterprise middleware.

ThreatBook Threat Detection Platform (TDP) captured live in-the-wild traffic exploiting Fastjson deployments at or below version 1.2.83 using two distinct payload signatures observed in the `@type` field: `@type":"jar:file:.` and `@type":"jar:http:..`. Analysis of the captured traffic confirmed exploitation via the `jar:http` variant against a Spring Boot FatJar application running on JDK 8, which triggers a remote JAR fetch (creating an SSRF condition) and forces the JVM's class loader to resolve and initialize an attacker-hosted class.

This technique aligns with a documented exploitation class publicly described for the fastjson 1.2.66–1.2.83 @JSONType remote-class-load RCE: the parser's `checkAutoType`/resource-probing logic performs `getResourceAsStream(typeName.replace('.','/') + ".class")`, which can be pointed at a remote JAR URL. Because the attacker-controlled class's static initializer (`<clinit>`) executes during the `@type` type-probe step — before Fastjson ever attempts to cast the resulting object to a bound DTO type — restricting the target Java type ("binding") does NOT mitigate the attack. Under JDK 8/Spring Boot FatJar conditions, the `jar:http` probe alone is sufficient for immediate code execution. Under newer JDK 17+ Linux targets, a two-step chain using `/proc/self/fd/N` can reopen a JAR cached by an initial `jar:http` probe as a `jar:file:` reference, achieving the same class-loading primitive even when AutoType is nominally disabled, so long as SafeMode and IgnoreAutoType are not enforced and outbound egress is permitted.

This vulnerability class is a direct descendant of the well-documented AutoType-bypass lineage in Fastjson, most notably CVE-2022-25845 (CVSS 3.1 base 8.1, some sources 9.8), in which Fastjson's `ThrowableDeserializer` was found to bypass the AutoType blacklist entirely for any class extending `java.lang.Throwable`, permitting arbitrary class instantiation regardless of the checkAutoType() blacklist result. Unlike CVE-2022-25845's Throwable-extension bypass, however, the XVE-2026-39684 activity ThreatBook captured relies on the remote-JAR/class-loader primitive rather than a Throwable-subclass gadget, and does not require a pre-existing exploitable gadget chain in the target's classpath (a constraint that historically limited real-world Fastjson RCE, since JFrog's CVE-2022-25845 research found no reliable, widely-applicable gadget chain beyond a low-impact Selenium WebDriverException data-leak primitive).

Exploitation requires no authentication, no user interaction, and no bypass of an additional security control beyond SafeMode being left disabled (the library's default posture on legacy 1.x deployments). Because Fastjson underpins countless internal APIs, message brokers, and microservice request/response pipelines, a successful hit typically yields immediate RCE in the context of the vulnerable JVM process, enabling webshell deployment, credential/secret harvesting from the host and any adjacent cloud metadata service, and lateral pivoting.

Separately, and providing broader threat-landscape context, botnets such as Androxgh0st have for several years incorporated Fastjson/Fastjson-adjacent JNDI-injection techniques (alongside Apache Shiro, jackson-databind, and Struts OGNL exploitation) into automated internet-wide scan-and-exploit operations targeting exposed Java services for credential harvesting and C2 logger hosting, illustrating the operational appetite for this vulnerability class among opportunistic, mass-exploitation threat actors even absent a named actor for this specific ThreatBook capture.

No CVE identifier has been assigned to the specific XVE-2026-39684 activity as of this writing, and ThreatBook's advisory does not publish a CVSS score; based on the unauthenticated, no-interaction, full-RCE impact profile consistent with the historical AutoType-bypass CVE-2022-25845 baseline, this threat is scored HIGH/CRITICAL-adjacent pending formal CVE/CVSS assignment.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1610 Deploy Container
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1518 Software Discovery
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1210 Exploitation of Remote Services
- T1489 Service Stop

## Sources

- [Fastjson RCE (≤ 1.2.83): Active Exploitation Detected](https://threatbook.io/blog/fastjson-rce-1.2.83-active-exploitation-detected-detection-mitigation)
- [CVE-2022-25845: Analyzing the Fastjson Auto-Type Bypass RCE Vulnerability](https://jfrog.com/blog/cve-2022-25845-analyzing-the-fastjson-auto-type-bypass-rce-vulnerability/)
- [High-Severity RCE Vulnerability Reported in Popular Fastjson Library](https://thehackernews.com/2022/06/high-severity-rce-vulnerability.html)
- [fastjson-jsontype-rce-lab: @JSONType remote-class-load RCE (1.2.66-1.2.83)](https://github.com/dinosn/fastjson-jsontype-rce-lab)
- [CVE-2022-25845 - Fastjson RCE vulnerability analysis](https://www.clouddefense.ai/cve/2022/CVE-2022-25845)
- [CVE-2022-25845: Alibaba Fastjson Remote Code Execution Vulnerability](https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/cve-2022-25845-alibaba-fastjson-remote-code-execution-vulnerability)
- [Deep Dive into Fastjson Deserialization Vulnerabilities: From Principles to Practical Defense](https://medium.com/@pa2sw0rd/deep-dive-into-fastjson-deserialization-vulnerabilities-from-principles-to-practical-defense-c3be134ec8a6)
- [Fastjson RCE: JNDI Injection via @type Deserialization](https://www.thehackerwire.com/fastjson-rce-jndi-injection-via-type-deserialization/)
- [CISA and FBI Release Known IOCs Associated with Androxgh0st Malware](https://www.cisa.gov/news-events/alerts/2024/01/16/cisa-and-fbi-release-known-iocs-associated-androxgh0st-malware)
- [Imperva Uncovers New IoCs for AndroxGh0st Botnet](https://www.imperva.com/blog/imperva-uncovers-new-indicators-of-compromise-for-androxgh0st-botnet/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1609