Active Exploits Target Unpatched Fastjson 1.x

Security researchers report active exploitation of a critical unauthenticated remote code execution vulnerability in the Fastjson Java library. Tracked as CVE-2026-16723 with a CVSS score of 9, the flaw affects Fastjson versions 1.2.68 through 1.2.83 and has been observed in attacks against applications packaged as Spring Boot executable fat-jars.

Alibaba, the library’s developer, said the flaw is exploitable under Fastjson’s default configuration and does not require AutoType to be enabled or any classpath gadget. ThreatBook warned that a successful exploit “can execute arbitrary code on a target server that has not enabled SafeMode, directly threatening the confidentiality, integrity, and availability of the system and potentially leading to full compromise of the server.”

Security vendor Imperva described the attack method: crafted JSON payloads with a malicious @type value cause Fastjson 1.x to perform attacker-controlled resource lookups and to treat @JSONType annotations as a trust signal during type resolution. That combination bypasses protections linked to disabling AutoType and creates a path to code execution.

Researchers have observed probes and attacks against organizations in the United States, Singapore and Canada across the finance, healthcare, retail and computing sectors. Many attempts impersonate common web browsers, while about 30 percent of observed scans originate from tools written in Ruby and Go.

The vulnerability can be exploited without authentication or user interaction and does not require external gadget libraries. Because many Spring Boot applications are distributed as fat-jars that bundle application code and dependencies, affected deployments that include Fastjson 1.2.68-1.2.83 should be treated as high-priority remediation targets.

Mitigation options include migrating to Fastjson 2.x, which is not affected, or enabling Fastjson’s SafeMode. Where migration is not immediately possible, organizations can block POST and JSON requests that contain known exploit strings, deploy a Fastjson build that removes AutoType-related code paths, apply network-level filters and review logs for suspicious JSON payloads to identify potential intrusions.

Fastjson is an open-source library originally created by Alibaba for JSON serialization and deserialization in Java. The 1.x branch is no longer supported; Fastjson 2.x introduced changes to type resolution and security hardening that prevent the specific annotation-based behavior exploited by CVE-2026-16723.

Vendors and researchers note there is no official patch for the affected 1.x releases and advise operators to inventory Java services that bundle Fastjson inside Spring Boot fat-jars and to apply migration or mitigations promptly.