Fastjson 1.x RCE Vulnerability Under Active Attack With No Patch Available

Security firms ThreatBook and Imperva report active exploitation of a critical remote code execution vulnerability in Alibaba’s Fastjson 1.x JSON library for Java, tracked as CVE-2026-16723. The flaw, assigned a CVSS score of 9.0 by Alibaba, allows unauthenticated attackers to execute arbitrary code on affected Spring Boot applications by sending a malicious JSON request. The attack chain requires Fastjson versions 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, and SafeMode disabled (default). No AutoType enablement or classpath gadget is needed.

As of July 25, 2026, Alibaba has not released a patched Fastjson 1.x version. Organizations unable to migrate immediately should enable SafeMode using -Dfastjson.parser.safeMode=true or use the restricted build 1.2.83_noneautotype. Alibaba recommends migrating to Fastjson2 as the long-term fix. The vulnerability was disclosed responsibly by Kirill Firsov of FearsOff Cybersecurity on July 21.

ThreatBook observed in-the-wild exploitation starting July 22, while Imperva reported activity targeting financial services, healthcare, retail, and other sectors, primarily in the United States, with smaller volumes in Singapore and Canada. Despite these reports, CISA’s Known Exploited Vulnerabilities catalog does not include this flaw as of July 25. Organizations should inventory Fastjson dependencies, inspect for suspicious @type values, nested JAR URLs, and unexpected outbound connections.