Critical Fastjson flaw actively exploited with no patch

A critical remote code execution vulnerability in Alibaba's ↗ 0.68% Fastjson library is under active exploitation, with no fix available for the affected 1.x branch and attackers already hitting production systems across the United States.

The Vulnerability

Tracked as CVE-2026-16723 and carrying a CVSS score of 9.0, the flaw affects Fastjson versions 1.2.68 through 1.2.83 — the entire final stretch of the now-archived 1.x release line. Alibaba published its advisory on July 21, 2026, following responsible disclosure by Kirill Firsov of FearsOff Cybersecurity.imperva+1

What makes the vulnerability especially dangerous is its low barrier to exploitation. It requires no authentication, no user interaction, no AutoType enablement, and no third-party gadget class on the classpath. An attacker sends crafted JSON containing a malicious `@type` value to any network-reachable endpoint that passes input to common parsing methods such as `JSON.parse` or `JSON.parseObject`. In Spring Boot fat-JAR deployments, the type-resolution logic can be abused through nested JAR URLs to load attacker-controlled bytecode.thehackernews+3

Alibaba has verified the exploit chain on Spring Boot 2.x, 3.x, and 4.x running JDK 8, 11, 17, and 21.imperva+1

Active Exploitation

By July 25, both ThreatBook and Imperva had confirmed in-the-wild exploitation. Imperva reported attacks spanning financial services, healthcare, computing, and retail, with activity "almost entirely targeting US-based organizations" along with a smaller number of cases in Singapore and Canada. Most attacks originated from browser-impersonating user agents, though tools written in Ruby and Go accounted for roughly 30 percent of observed traffic.securityonline+1

A working proof-of-concept exploit is now publicly available, according to SecurityOnline.securityonline

No Patch, Only Workarounds

Because Fastjson 1.x is no longer maintained, Alibaba has not shipped a patched release and is unlikely to do so. Organizations are advised to enable SafeMode immediately using the JVM flag `-Dfastjson.parser.safeMode=true`, adopt the restricted `1.2.83_noneautotype` build, or migrate to Fastjson 2.x, which does not employ the vulnerable resource-probing mechanism.threatbook+2

As The Hacker News noted, Fastjson 1.2.83 was itself the recommended upgrade for a separate AutoType bypass disclosed in 2022 — meaning organizations that followed prior guidance now find themselves inside the affected range with no safe 1.x version to move to.thehackernews