Security experts have identified an ongoing exploitation of a significant vulnerability in Fastjson, a JSON library developed by Alibaba for Java. This flaw, impacting certain Spring Boot applications, allows unauthorized code execution with the same permissions as the Java process. The vulnerability is designated as CVE-2026-16723 and has been given a high severity score of 9.0 according to the Common Vulnerability Scoring System (CVSS).
Details of the Vulnerability
The affected versions of Fastjson are from 1.2.68 to 1.2.83, particularly within Spring Boot’s executable fat-JARs. The vulnerability can be exploited through a network-accessible path that processes attacker-controlled JSON data, especially if the SafeMode feature is not enabled, which is its default setting. Notably, the exploitation does not require AutoType to be active or a specific classpath gadget.
As of July 25, no patched version has been released by Alibaba. Organizations using Fastjson are advised to enable SafeMode by configuring with -Dfastjson.parser.safeMode=true or using a restricted build like com.alibaba:fastjson:1.2.83_noneautotype. Transitioning to Fastjson2 is recommended as a permanent solution.
Analysis of Exploit Techniques
The vulnerability’s roots lie in Fastjson’s type-resolution mechanism, where an attacker can manipulate the @type value leading to a class-resource lookup. This method works effectively in systems using Spring Boot fat-JARs, facilitating the execution of attacker-supplied bytecode. Additionally, @JSONType annotations can be misused as trust indicators, allowing malicious classes to bypass type checks.
Security firm ThreatBook reported observing real-world exploitation shortly after deploying detection methods. It noted successful execution of code within a Spring Boot fat-JAR environment running JDK 8, although other tests resulted in limited outcomes such as remote JAR retrievals.
Impact on Various Sectors
Imperva highlighted that sectors like financial services, healthcare, and retail in the United States are primarily targeted, with some activity detected in Singapore and Canada. The majority of attacks involved browser impersonation techniques, with Ruby and Go tools accounting for a substantial portion of the attack methods.
Despite the observed exploitation, no concrete evidence of successful breaches has been published by the vendors. The Cybersecurity and Infrastructure Security Agency (CISA) also noted the absence of this vulnerability in its Known Exploited Vulnerabilities catalog, indicating no official confirmation of successful attacks.
Recommendations for Organizations
Organizations are urged to assess their systems for Fastjson dependencies, particularly looking for suspicious @type values and other anomalies. Transitioning to Fastjson2 is strongly advised, as it is not susceptible to the same exploitation techniques. Ongoing vigilance and system audits are essential to mitigate potential risks associated with this vulnerability.
The Hacker News reached out to Alibaba and Imperva for further clarification on the vulnerability and its exploitation, with updates to follow pending responses. In the meantime, Fastjson 1.2.83 remains the latest available version, although it falls within the affected range for the identified flaw.
