# Fastjson 1.x RCE (CVE-2026-16723) — Gadget-Free Deserialization Bypass Actively Exploited in Spring Boot Fat-JAR Deployments

> A CVSS 9.0 remote code execution vulnerability in Fastjson 1.2.68-1.2.83 (the final 1.x release) lets an unauthenticated attacker submit a crafted @type value that abuses fastjson's checkAutoType resource-probing logic to force Spring Boot's LaunchedURLClassLoader to fetch and initialize attacker-controlled bytecode — no AutoType enablement and no classpath gadget required. ThreatBook confirmed in-the-wild exploitation on July 22, 2026, primarily against US financial services, healthcare, computing, retail, and business-sector organizations (with secondary activity in Singapore and Canada), even though no fixed 1.x version exists and CISA has not added the CVE to its KEV catalog.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-09-17T00:53:49.881Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1682
- **ID:** TL-2026-1682
- **Severity:** CRITICAL (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-16723

## Description

CVE-2026-16723 is a critical (CVSS 9.0) remote code execution vulnerability affecting Apache-style JSON library Fastjson (Alibaba) versions 1.2.68 through 1.2.83 — the final release of the 1.x line before the project moved to Fastjson2. Discovered by Kirill Firsov of FearsOff Cybersecurity and disclosed July 19, 2026, the flaw is exploitable under fastjson's stock default configuration: AutoType does not need to be enabled, and no classpath gadget class is required, which distinguishes it from prior fastjson deserialization CVEs (e.g., CVE-2022-25845) that depended on gadget chains.

The root cause lives in ParserConfig.checkAutoType, which probes every @type value for the presence of a @JSONType annotation by calling getResourceAsStream(typeName.replace('.','/') + ".class"). When the probed resource is a remote jar:http URL, fastjson performs an HTTP fetch of that class file purely to check for the annotation — but on Spring Boot fat-JAR deployments running on Linux, the fetched JAR is cached with an open file descriptor. A second, correlated @type probe inside the same request body targeting jar:file:/proc/self/fd/N can reopen that cached resource and load it through Spring Boot's LaunchedURLClassLoader as an attacker-named class. Because the target class's static initializer (<clinit>) executes during the @type probe itself — before fastjson ever attempts to cast the resolved object to a declared field type — the attacker achieves code execution even when the calling code binds to a fixed DTO. The advisory explicitly warns that specifying a target class in JSON.parseObject(body, SomeDto.class) is NOT a mitigation, because payloads can be nested inside Object- or Map-typed fields of that DTO. The @JSONType annotation itself functions as an unintended trust signal that bypasses fastjson's dangerous-base-class checks.

Exploitation requires: (1) a network-reachable endpoint that parses attacker-supplied JSON via JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class); (2) a Spring Boot executable fat-JAR deployment (not a plain WAR or generic uber-JAR); (3) SafeMode disabled (the default state); and (4) outbound HTTP egress from the application server to fetch the remote class resource. The technique has been verified to work across Spring Boot 2.x, 3.x, and 4.x and JDK 8, 11, 17, and 21 (with a documented '/proc/self/fd trick' extending applicability up through JDK 25 in follow-on research). No classpath gadget is needed on any of these combinations.

ThreatBook reported active in-the-wild exploitation captured July 22, 2026, three days after public disclosure. Imperva's telemetry shows attacks concentrated against Financial Services, Healthcare, Computing, Retail, and Business-sector targets, almost entirely against US-based organizations with secondary activity in Singapore and Canada. Attack traffic is dominated by requests spoofing ordinary browser user-agents, with tooling written in Ruby and Go collectively representing roughly 30% of observed attack traffic. Despite confirmed active exploitation reported by two independent commercial threat intelligence sources (ThreatBook, Imperva), CISA's automated Authorized Data Publisher (ADP) assessment marked exploitation status as 'none' as of July 23, 2026, and the CVE remains absent from the CISA KEV catalog as of the July 25, 2026 reporting date — a discrepancy defenders should not rely on when prioritizing patching.

No fixed Fastjson 1.x release exists. Alibaba's guidance is to enable SafeMode (-Dfastjson.parser.safeMode=true) or adopt the com.alibaba:fastjson:1.2.83_noneautotype build variant, which removes the vulnerable resource-probing code path at compile time; the durable fix is migration to Fastjson2, which is architecturally unaffected because it does not perform equivalent getResourceAsStream probing on user-controlled class names and instead uses an allowlist-first model for polymorphic type handling. fastjson versions 1.2.60 and earlier, non-fat-JAR deployments (traditional WAR/Tomcat/Jetty), and deployments with SafeMode already enabled are not affected. Public proof-of-concept exploit tooling and a defensive scanner suite (fjdetect.py, fjscan_static.py, fjscan_probe.py) were published to GitHub within days of disclosure, lowering the barrier to further mass exploitation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1592 Gather Victim Host Information
- T1046 Network Service Discovery
- T1190 Exploit Public-Facing Application
- T1129 Shared Modules
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1211 Exploitation for Stealth
- T1518 Software Discovery
- T1057 Process Discovery
- T1036 Masquerading
- T1059.004 Unix Shell
- T1588.006 Vulnerabilities
- T1595.002 Vulnerability Scanning
- T1587.001 Malware
- T1583.004 Server
- T1505.003 Web Shell
- T1071.001 Web Protocols

## Sources

- [Fastjson 1.x RCE Vulnerability Actively Targeted](https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html)
- [Security Advisory: Remote Code Execution in fastjson 1.2.68-1.2.83](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)
- [NVD - CVE-2026-16723](https://nvd.nist.gov/vuln/detail/CVE-2026-16723)
- [Imperva Customers Protected Against CVE-2026-16723: Critical FastJson 1.x Zero-Day RCE](https://securityboulevard.com/2026/07/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/)
- [FastJson 1.2.83 Remote Code Execution](https://fearsoff.org/research/fastjson-1-2-83-rce)
- [Public PoC Exploit Released for fastjson 1.2.83 Remote Code Execution Flaw](https://securityonline.info/fastjson-rce-1-2-83/)
- [fastjson-jsontype-rce-lab: Docker lab + one-payload exploit + defensive scanner](https://github.com/dinosn/fastjson-jsontype-rce-lab)
- [fastjson-1.2.83-gadget-rce: multi-JDK PoC with batch URL verification](https://github.com/midisec/fastjson-1.2.83-gadget-rce)
- [Kirill Firsov (@k_firsov) — gadget-free RCE in Fastjson 1.2.83 disclosure thread](https://x.com/k_firsov/status/2078872293745570032)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1682