Fastjson 1.x RCE (CVE-2026-16723) — Gadget-Free Deserialization Bypass Actively Exploited in Spring Boot Fat-JAR Deployments — Threadlinqs Intelligence
As of 2026-07-25, Fastjson 1.x RCE (CVE-2026-16723) — Gadget-Free Deserialization Bypass Actively Exploited in Spring Boot Fat-JAR Deployments is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1682 · Severity: CRITICAL · CVSS: 9 · Status: ACTIVE · Category: VULNERABILITY
A CVSS 9.0 remote code execution vulnerability in Fastjson 1.2.68-1.2.83 (the final 1.x release) lets an unauthenticated attacker submit a crafted @type value that abuses fastjson's checkAutoType
CVE-2026-16723 is a critical (CVSS 9.0) remote code execution vulnerability affecting Apache-style JSON library Fastjson (Alibaba) versions 1.2.68 through 1.2.83 — the final release of the 1.x line before the project moved to Fastjson2. Discovered by Kirill Firsov of FearsOff Cybersecurity and disclosed July 19, 2026, the flaw is exploitable under fastjson's stock default configuration: AutoType does not need to be enabled, and no classpath gadget class is required, which distinguishes it from prior fastjson deserialization CVEs (e.g., CVE-2022-25845) that depended on gadget chains.
The root cause lives in ParserConfig.checkAutoType, which probes every @type value for the presence of a @JSONType annotation by calling getResourceAsStream(typeName.replace('.','/') + ".class"). When the probed resource is a remote jar:http URL, fastjson performs an HTTP fetch of that class file purely to check for the annotation — but on Spring Boot fat-JAR deployments running on Linux, the fetched JAR is cached with an open file descriptor. A second, correlated @type probe inside the same request body targeting jar:file:/proc/self/fd/N can reopen that cached resource and load it through Spring Boot's LaunchedURLClassLoader as an attacker-named class. Because the target class's static initializer (<clinit>) executes during the @type probe itself — before fastjson ever attempts to cast the resolved object to a declared field type — the attacker achieves code execution even when the calling code binds to a fixed DTO. The advisory explicitly warns that specifying a target class in JSON.parseObject(body, SomeDto.class) is NOT a mitigation, because payloads can be nested inside Object- or Map-typed fields of that DTO. The @JSONType annotation itself functions as an unintended trust signal that bypasses fastjson's dangerous-base-class checks.
Exploitation requires: (1) a network-reachable endpoint that parses attacker-supplied JSON via JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class); (2) a Spring Boot executable fat-JAR deployment (not a plain WAR or generic uber-JAR); (3) SafeMode disabled (the default state); and (4) outbound HTTP egress from the application server to fetch the remote class resource. The technique has been verified to work across Spring Boot 2.x, 3.x, and 4.x and JDK 8, 11, 17, and 21 (with a documented '/proc/self/fd trick' extending applicability up through JDK 25 in follow-on research). No classpath gadget is needed on any of these combinations.
ThreatBook reported active in-the-wild exploitation captured July 22, 2026, three days after public disclosure. Imperva's telemetry shows attacks concentrated against Financial Services, Healthcare, Computing, Retail, and Business-sector targets, almost entirely against US-based organizations with secondary activity in Singapore and Canada. Attack traffic is dominated by requests spoofing ordinary browser user-agents, with tooling written in Ruby and Go collectively representing roughly 30% of observed attack traffic. Despite confirmed active exploitation reported by two independent commercial threat intelligence sources (ThreatBook, Imperva), CISA's automated Authorized Data Publisher (ADP) assessment marked exploitation status as 'none' as of July 23, 2026, and the CVE remains absent from the CISA KEV catalog as of the July 25, 2026 reporting date — a discrepancy defenders should not rely on when prioritizing patching.
No fixed Fastjson 1.x release exists. Alibaba's guidance is to enable SafeMode (-Dfastjson.parser.safeMode=true) or adopt the com.alibaba:fastjson:1.2.83_noneautotype build variant, which removes the vulnerable resource-probing code path at compile time; the durable fix is migration to Fastjson2, which is architecturally unaffected because it does not perform equivalent getResourceAsStream probing on user-controlled class names and instead uses an allowlist-first model for polymorphic type handling. fastjson versions 1.2.60 and earlier, non-fat
Weaknesses (CWE)
CWE-502, CWE-20
Target sectors: financial-services, health, computing, retail, business
Target regions: united states of america, singapore, canada
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-16723, T1595, T1588, T1583, T1588, T1592, T1046, T1190, T1129, T1059, T1505