Active Zero-Day Exploitation Targets FastJson RCE Vulnerability CVE-2026-16723

Threat actors are actively exploiting an unpatched remote code execution vulnerability in FastJson, the widely used open-source Java library developed by Alibaba. Tracked as CVE-2026-16723, the zero-day flaw enables unauthenticated remote attackers to execute arbitrary code on target servers without requiring user interaction, administrative privileges, or complex gadget chains.

The vulnerability primarily affects organizations running Spring Boot applications packaged as executable fat-JAR files. Active in-the-wild exploitation was spotted last week by security firm ThreatBook and confirmed by Imperva, with initial attacks targeting enterprise networks across the United States, as well as organizations in Singapore and Canada.

Understanding CVE-2026-16723

FastJson relies on polymorphic deserialization to map incoming JSON payloads back into concrete Java objects, frequently utilizing a special @type annotation in the JSON structure to determine which Java class should be instantiated. Because arbitrary object instantiation during deserialization is a historically dangerous flaw class, FastJson introduced an “AutoType” safety mechanism intended to restrict class loading to explicit allowlists or block dangerous gadget classes.

CVE-2026-16723 bypasses these security controls entirely. Discovered by offensive security company FearsOff, which published technical details earlier this month, the flaw resides in FastJson’s core type-resolution logic. When parsing a payload, FastJson performs attacker-controlled resource lookups before enforcing AutoType restriction checks.

When an application is executed as a Spring Boot fat-JAR (java -jar application.jar), the specialized classloading behavior of the fat-JAR structure interacts with FastJson’s early resource lookup. This structural quirk allows an attacker to abuse @type processing to load and execute malicious classes directly from the deployment context. The exploit requires no third-party gadget chains and works even when AutoType is explicitly turned off.

Alibaba has acknowledged the severity of the flaw in a security advisory, confirming that specifying concrete target classes during deserialization does not protect applications, as attackers can nest malicious payloads within generic Object or Map fields.

Impact and Target Blast Radius

FastJson is deeply embedded across the global software supply chain, boasting over 25,000 stars and 6,000 forks on GitHub. It is particularly ubiquitous in software built on Alibaba’s cloud platform and within Chinese enterprise software distributions, though its lightweight nature has led to broad adoption worldwide.

Imperva’s telemetry indicates that threat actors are conducting sweeping scanning and exploitation campaigns against a broad range of sectors, including Financial Services, Healthcare, Computing, Retail, and Business Services.

Because the vulnerability yields immediate remote code execution inside the worker process of the Java Virtual Machine (JVM), the blast radius for an affected organization is severe:

• Initial Access & Persistence: Successful exploitation gives the attacker shell access within the context of the running Spring Boot application user.
• Credential & Data Theft: Attackers gain direct memory and file-system access to environment variables, API tokens, database connection strings, and backend microservice credentials stored in the application context.
• Lateral Movement: Once inside the host or container execution space, attackers can leverage local access to pivot into internal container registries, Kubernetes control planes, or corporate networks.

Scope of Impact and Affected Versions

The vulnerability specifically impacts FastJson versions 1.2.68 through 1.2.83.

The attack surface requires a specific deployment configuration to be exploitable:

• The application must use an affected FastJson 1.x version.
• The application must be deployed and launched as a Spring Boot executable fat-JAR (e.g., java -jar app.jar).

Unaffected Configurations:

• Applications using FastJson 1.2.60 and earlier are not affected by this specific type-resolution flaw.
• Non-fat-JAR deployments (such as traditional WAR deployments running inside external web containers) are not vulnerable to this attack vector.
• The fastjson2 library is entirely unaffected. FastJson 2.x was rewritten to use an allowlist-first model for polymorphic deserialization and does not rely on the @JSONType annotation as a trust signal.

Mitigation and Remediation Strategy

There is currently no vendor security patch available for CVE-2026-16723. Furthermore, because FastJson 1.x is officially end-of-life and no longer actively maintained by Alibaba, a backported security patch for the 1.x branch is unexpected. Engineering teams must take proactive steps to mitigate exposure immediately.

1. Enable SafeMode in FastJson 1.x: If immediate code refactoring is not possible, explicitly enable SafeMode in your application startup logic. SafeMode completely disables @type parsing during deserialization, rendering the attack vector non-functional.

   com.alibaba.fastjson.parser.ParserConfig.getGlobalInstance().setSafeMode(true);

2. Migrate to fastjson2: The primary long-term resolution is migrating dependencies from com.alibaba:fastjson to com.alibaba.fastjson2:fastjson2. The 2.x branch enforces strict allowlist-first parsing and is immune to this classloader lookup bypass.
3. Deploy Web Application Firewall (WAF) Rules: Filter incoming HTTP requests to block JSON payloads containing the @type key directed toward endpoint parameters, particularly those interacting with Spring Boot controllers handling untyped JSON objects or maps.