Fastjson 1.x RCE (CVE-2026-16723) — Gadget-Free Deserialization Bypass Actively Exploited in Spring Boot Fat-JAR Deployments

Fastjson 1.x RCE (CVE-2026-16723) (TL-2026-1682), also tracked as QVD-2026-43021, is a critical-severity software vulnerability scored CVSS 9, first published 2026-07-25 and last reviewed 2026-07-28. It has no confirmed attribution, affects Alibaba Fastjson, references 1 CVE (CVE-2026-16723), maps to 24 MITRE ATT&CK techniques (T1027, T1036, T1046), and is covered by 9 detection rules and 38 indicators of compromise.

Key facts for TL-2026-1682

Threat ID
TL-2026-1682
Also known as
QVD-2026-43021
Severity
CRITICAL
CVSS
9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-25
Last reviewed
2026-07-28
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
financial-services, health, computing, retail, business
Target regions
united states of america, singapore, canada
Detection rules
9
Indicators of compromise
38
Updates
2026-07-28 · 2 updates · revalidated 2× · latest source

Malware and tooling in Fastjson 1.x RCE (CVE-2026-16723)

Malware and tooling: fastjson-1.2.83-gadget-rce, fastjson-jsontype-rce-lab

A CVSS 9.0 remote code execution vulnerability in Fastjson 1.2.68-1.2.83 (the final 1.x release) lets an unauthenticated attacker submit a crafted @type value that abuses fastjson's checkAutoType resource-probing logic to force Spring Boot's LaunchedURLClassLoader to fetch and initialize attacker-controlled bytecode — no AutoType enablement and no classpath gadget required. ThreatBook confirmed in-the-wild exploitation on July 22, 2026, primarily against US financial services, healthcare, computing, retail, and business-sector organizations (with secondary activity in Singapore and Canada), even though no fixed 1.x version exists and CISA has not added the CVE to its KEV catalog.

How Fastjson 1.x RCE (CVE-2026-16723) works

CVE-2026-16723 is a critical (CVSS 9.0) remote code execution vulnerability affecting Apache-style JSON library Fastjson (Alibaba) versions 1.2.68 through 1.2.83 — the final release of the 1.x line before the project moved to Fastjson2. Discovered by Kirill Firsov of FearsOff Cybersecurity and disclosed July 19, 2026, the flaw is exploitable under fastjson's stock default configuration: AutoType does not need to be enabled, and no classpath gadget class is required, which distinguishes it from prior fastjson deserialization CVEs (e.g., CVE-2022-25845) that depended on gadget chains.

The root cause lives in ParserConfig.checkAutoType, which probes every @type value for the presence of a @JSONType annotation by calling getResourceAsStream(typeName.replace('.','/') + ".class"). When the probed resource is a remote jar:http URL, fastjson performs an HTTP fetch of that class file purely to check for the annotation — but on Spring Boot fat-JAR deployments running on Linux, the fetched JAR is cached with an open file descriptor. A second, correlated @type probe inside the same request body targeting jar:file:/proc/self/fd/N can reopen that cached resource and load it through Spring Boot's LaunchedURLClassLoader as an attacker-named class. Because the target class's static initializer (<clinit>) executes during the @type probe itself — before fastjson ever attempts to cast the resolved object to a declared field type — the attacker achieves code execution even when the calling code binds to a fixed DTO. The advisory explicitly warns that specifying a target class in JSON.parseObject(body, SomeDto.class) is NOT a mitigation, because payloads can be nested inside Object- or Map-typed fields of that DTO. The @JSONType annotation itself functions as an unintended trust signal that bypasses fastjson's dangerous-base-class checks.

Exploitation requires: (1) a network-reachable endpoint that parses attacker-supplied JSON via JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class); (2) a Spring Boot executable fat-JAR deployment (not a plain WAR or generic uber-JAR); (3) SafeMode disabled (the default state); and (4) outbound HTTP egress from the application server to fetch the remote class resource. The technique has been verified to work across Spring Boot 2.x, 3.x, and 4.x and JDK 8, 11, 17, and 21 (with a documented '/proc/self/fd trick' extending applicability up through JDK 25 in follow-on research). No classpath gadget is needed on any of these combinations.

ThreatBook reported active in-the-wild exploitation captured July 22, 2026, three days after public disclosure. Imperva's telemetry shows attacks concentrated against Financial Services, Healthcare, Computing, Retail, and Business-sector targets, almost entirely against US-based organizations with secondary activity in Singapore and Canada. Attack traffic is dominated by requests spoofing ordinary browser user-agents, with tooling written in Ruby and Go collectively representing roughly 30% of observed attack traffic. Despite confirmed active exploitation reported by two independent commercial threat intelligence sources (ThreatBook, Imperva), CISA's automated Authorized Data Publisher (ADP) assessment marked exploitation status as 'none' as of July 23, 2026, and the CVE remains absent from the CISA KEV catalog as of the July 25, 2026 reporting date — a discrepancy defenders should not rely on when prioritizing patching.

No fixed Fastjson 1.x release exists. Alibaba's guidance is to enable SafeMode (-Dfastjson.parser.safeMode=true) or adopt the com.alibaba:fastjson:1.2.83_noneautotype build variant, which removes the vulnerable resource-probing code path at compile time; the durable fix is migration to Fastjson2, which is architecturally unaffected because it does not perform equivalent getResourceAsStream probing on user-controlled class names and instead uses an allowlist-first model for polymorphic type handling. fastjson versions 1.2.60 and earlier, non-fat-JAR deployments (traditional WAR/Tomcat/Jetty), and deployments with SafeMode already enabled are not affected. Public proof-of-concept exploit tooling and a defensive scanner suite (fjdetect.py, fjscan_static.py, fjscan_probe.py) were published to GitHub within days of disclosure, lowering the barrier to further mass exploitation.

MITRE ATT&CK techniques used in TL-2026-1682

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1211 Exploitation for Stealth; T1620 Reflective Code Loading

Discovery

T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1129 Shared Modules

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Persistence

T1505 Server Software Component

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1588.006 Vulnerabilities; T1608 Stage Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in Fastjson 1.x RCE (CVE-2026-16723)

  • Alibaba — Fastjson
    Vulnerable versions: 1.2.68; 1.2.69; 1.2.70; 1.2.71; 1.2.72; 1.2.73; 1.2.74; 1.2.75; 1.2.76; 1.2.77
    Fixed in: 1.2.83_noneautotype (mitigated build, not a security fix); Fastjson2 (all versions, architecturally unaffected)

Remediation for Fastjson 1.x RCE (CVE-2026-16723)

Patches

  • No fixed Fastjson 1.x version has been released as of July 25, 2026 — SafeMode and the noneautotype build are mitigations, not patches

Immediate actions

  • Enable Fastjson SafeMode via -Dfastjson.parser.safeMode=true (or the programmatic ParserConfig.getGlobalInstance().setSafeMode(true) equivalent) on every JVM running fastjson 1.2.68-1.2.83
  • Swap to the com.alibaba:fastjson:1.2.83_noneautotype build, which strips the vulnerable resource-probing code path at compile time
  • Block or restrict outbound HTTP/JAR-fetch egress from application servers so the jar:http probe step cannot reach attacker infrastructure
  • Inventory all direct and transitive dependencies on fastjson 1.2.68-1.2.83 across Spring Boot fat-JAR services
  • Review WAF/ingress logs for @type fields containing jar:http, jar:file:/proc/self/fd, or /dev/fd path fragments in JSON request bodies
  • Hunt for unexpected child processes, web shell artifacts, and unauthorized file system changes on internet-facing Spring Boot hosts

Workarounds

  • Deploy affected services as traditional WAR files under Tomcat/Jetty instead of Spring Boot executable fat-JARs, which removes the LaunchedURLClassLoader gadget-free path
  • Terminate JSON-parsing endpoints behind a WAF capable of blocking @type values containing jar: schemes

Longer-term hardening

  • Migrate from Fastjson 1.x to Fastjson2, which does not perform equivalent getResourceAsStream probing on user-controlled class names and uses an allowlist-first polymorphic type model
  • Adopt egress-filtering/zero-trust network policies for application-tier JVMs to prevent SSRF-style class-resource fetches regardless of library-level fixes
  • Add automated dependency scanning (e.g., fjscan_static.py-style build inventory) to CI/CD to catch vulnerable fastjson + fat-jar classloader combinations before deployment

CVEs associated with Fastjson 1.x RCE (CVE-2026-16723)

CVE-2026-16723

Weaknesses (CWE) in Fastjson 1.x RCE (CVE-2026-16723)

CWE-502, CWE-20

Timeline of Fastjson 1.x RCE (CVE-2026-16723)

  • Kirill Firsov of FearsOff Cybersecurity discloses a gadget-free RCE in Fastjson 1.2.83, the final release of the 1.x line, requiring no classpath gadget and working with a single payload.
  • ThreatBook TDP ships detection support (rule/model version 20260720000000, detection ID S3100181015) ahead of public disclosure.
  • Alibaba publishes a GitHub security advisory for CVE-2026-16723 covering fastjson 1.2.68-1.2.83; no fixed 1.x version is released, only SafeMode and noneautotype mitigations.
  • Two more public PoC exploits surface (0x7eTeam/fastjson-1.2.83-rce, wouijvziqy/Fastjson-JsonType-RCE-PoC), joining the two already tracked.
  • ThreatBook captures and reports active in-the-wild exploitation of CVE-2026-16723.
  • Tenable Research classifies CVE-2026-16723 as a 'Vulnerability of Interest,' publishing a CVSS v2 score of 7.6 alongside an EPSS exploitation-probability score of 0.00663.
  • NVD formally publishes the CVE-2026-16723 entry.
  • Public proof-of-concept exploit tooling and defensive scanners (fjdetect.py, fjscan_static.py, fjscan_probe.py) are published to GitHub, alongside a separate multi-JDK batch-verification PoC.
  • CISA's Authorized Data Publisher (ADP) assessment marks exploitation status as 'none' for CVE-2026-16723, despite independent reports of active exploitation.
  • FearsOff publishes the full technical exploit chain writeup (SSRF in checkAutoType, @JSONType bypass, /proc/self/fd trick) at fearsoff.org.
  • Imperva publishes telemetry showing exploitation attempts concentrated against US financial services, healthcare, computing, retail, and business-sector organizations, with secondary activity in Singapore and Canada.
  • The Hacker News reports on the vulnerability and active exploitation, noting CVE-2026-16723 remains absent from the CISA KEV catalog as of publication.
  • Rescana and Latest Hacking News publish independent active-exploitation alerts and exposure-check guidance; CVE still absent from CISA KEV.
  • BleepingComputer reports active zero-day attacks against US financial, healthcare, computing, retail, and business organizations, with secondary Singapore/Canada targeting.
  • SecurityWeek reports on the active exploitation campaign, citing the Alibaba advisory, ThreatBook, and Imperva findings.

Update history for TL-2026-1682

Sources cited for Fastjson 1.x RCE (CVE-2026-16723)

Threats related to Fastjson 1.x RCE (CVE-2026-16723)

Detection coverage for TL-2026-1682

As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1682 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats