CVE-2026-16723: Critical Fastjson RCE Vulnerability Actively Exploited — No Patch Available

Exploitation Characteristics

This vulnerability breaks the mold of previous Fastjson exploits in three important ways:

• No AutoType required: Unlike earlier Fastjson RCEs, this vulnerability works under stock default configuration — AutoType does not need to be enabled .
• No classpath gadgets required: The exploit does not depend on any third-party gadget classes being present on the classpath .
• No authentication, no user interaction: An unauthenticated attacker can send a crafted JSON payload over the network and achieve RCE without any user action .

Affected Deployment Configuration

The exploit is not universal across all Fastjson usage. It requires all of the following conditions :

1. Fastjson 1.2.68–1.2.83 in use.
2. Application deployed as a Spring Boot executable fat-JAR.
3. SafeMode disabled (which is the default).
4. Externally controlled JSON reaches a Fastjson parser entry point (e.g., JSON.parse, JSON.parseObject).

Standard non-fat JAR deployments, WAR deployments on Tomcat/Jetty, and generic uber-JARs are not affected .

Confirmed impact: Spring Boot 2.x–4.x across JDK 8 through JDK 21. The vulnerability is in the Fastjson library itself, not in the JDK, so all supported JDK versions carrying vulnerable Fastjson are at risk .

Active In-the-Wild Exploitation

• Observed targeting: ThreatBook and Imperva have observed active exploitation primarily targeting US-based organizations .
• Industry sectors under attack: Financial services, healthcare, computing/technology, and retail .
• Timeline: Attackers began exploiting the flaw within approximately one day of disclosure (July 19–20, 2026) .
• IOCs available: Threadlinqs Intelligence tracks 23 indicators of compromise and 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) .

Recommended Mitigations (No Patch Available)

Since Alibaba has not released a patched 1.x Fastjson release, organizations must apply one of the following workarounds :

1. Enable SafeMode — Set the JVM system property -Dfastjson.parser.safeMode=true. This disables all deserialization of arbitrary classes .
2. Use the restricted build — Replace the standard artifact with com.alibaba:fastjson:1.2.83_noneautotype, a special build that strips AutoType support entirely .
3. Migrate to Fastjson 2.x — Fastjson 2.x is architecturally immune to this class of attack and is the recommended long-term solution .

Additional detection guidance: Monitor logs for suspicious @type values, nested JAR URLs in JSON payloads, and unexpected outbound network connections from application servers .

Key Caveats

• No patched 1.x release exists as of July 26, 2026. The three mitigations above are the only available options .
• The exploit requires the specific Spring Boot fat-JAR deployment pattern — this narrows the real-world blast radius but still leaves a very large number of enterprise Spring Boot applications exposed .
• Some early CVE listings (e.g., cve.radio) initially stated "no public exploitation reported," but that information is now outdated given confirmed reports from Imperva, ThreatBook, and Threadlinqs .