---
schema: 1
kind: vulnerability
title: "CVE-2026-16723 — Alibaba fastjson 1.2.68–1.2.83: remote code execution under stock defaults in Spring Boot fat-JARs, exploited in the wild with no 1.x patch"
headline: "Exploited fastjson 1.x RCE has no patch — Spring Boot fat-JAR estates need SafeMode or migration now"
summary: >
  A remote code execution flaw in Alibaba fastjson 1.2.68 through 1.2.83 (CVE-2026-16723, CVSS 9.0)
  triggers under the library's stock default configuration — no AutoType, no classpath gadget — whenever
  the application runs as a Spring Boot executable fat-JAR, and specifying a target DTO class does not
  mitigate it. Imperva reports attacks already underway against financial-services, healthcare and retail
  targets. fastjson 1.x is end-of-life and no patched 1.x release exists, so the only remediations are
  enabling SafeMode, switching to a noneautotype build, or migrating to fastjson2.
discovered_at: "2026-07-27T04:33:46Z"
event_date: "2026-07-24"
run_id: 2026-07-27T0409Z-intel
priority: high
immediate_action: null
tags:
  - vulnerabilities
  - rce
  - actively-exploited
  - pre-auth
  - default-config
  - no-patch
regions:
  - global
sectors:
  - finance
  - healthcare
  - technology
  - retail
entities: []
techniques:
  - T1190
affected_products:
  - "Alibaba fastjson"
cves:
  - id: CVE-2026-16723
    cvss: "9.0"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status:
      - exploited
      - no-patch
      - mitigation-only
    affected: "1.2.68 through 1.2.83 (1.2.83 is the final 1.x release), when deployed as a Spring Boot executable fat-JAR under stock defaults"
    fixed: "No fixed 1.x release exists — the line is unmaintained. Vendor remediation is SafeMode (-Dfastjson.parser.safeMode=true), the 1.2.83_noneautotype build, or migration to fastjson2 (all fastjson2 versions unaffected)."
sources:
  - url: "https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83"
    publisher: "Alibaba fastjson2 project"
    date: "2026-07-21"
    role: primary
  - url: "https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/"
    publisher: "Imperva"
    date: "2026-07-24"
    role: corroborating
closed_sources: []
evidence:
  - quote: "A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required."
    publisher: "Alibaba fastjson2 project"
  - quote: "So far, attacks exploiting this vulnerability are targeting a wide range of organizations, across Financial Services, Healthcare, Computing, Retail, Business, and other industries."
    publisher: "Imperva"
  - quote: "FastJson 1.x is no longer actively maintained, and no patched 1.x version has been released for this vulnerability."
    publisher: "Imperva"
verification: multi-source
sourcing_note: >
  The vulnerability and its remediation come from the maintainer's own advisory; the exploitation claim
  rests on Imperva's own WAF telemetry and is not independently corroborated. CISA's SSVC record for this
  CVE, timestamped 2026-07-23, still scores exploitation as none — it predates Imperva's 2026-07-24 report
  rather than contradicting it. The CVSS 9.0 is the score Alibaba assigned as CNA (CVSS v3.1, attack
  complexity high); no national CERT in Switzerland, the Netherlands, Germany, France, Poland or at EU
  level had published on this CVE at the time of writing.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Inventory Java estates for fastjson 1.2.68–1.2.83 — including transitive dependencies inside vendor-supplied Spring Boot fat-JARs — and on every hit enable SafeMode (`-Dfastjson.parser.safeMode=true`) or swap to the `1.2.83_noneautotype` build; there is no patched 1.x release to wait for."
migrated_from: null
---

Alibaba's fastjson 1.2.68 through 1.2.83 carries a remote code execution flaw that fires under the library's shipped defaults: "This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required" ([Alibaba fastjson2 project, 2026-07-21](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)). The single deployment precondition is that the application runs as a Spring Boot executable fat-JAR, which the maintainer notes is the most common Spring Boot deployment model, and the advisory records end-to-end verification across Spring Boot 2.x/3.x/4.x and JDK 8, 11, 17 and 21. All three common entry points — `JSON.parse`, `JSON.parseObject(String)` and `JSON.parseObject(String, Class)` — are reachable, and the defensive habit most teams rely on does not help: passing a concrete target class is explicitly *not* a mitigation, because a payload can be nested inside any `Object`- or `Map`-typed field of that DTO (same advisory). The root cause is fastjson 1.x resolving user-controlled class names through a resource-probing path and treating the `@JSONType` annotation as a trust signal — behaviour fastjson2 removes architecturally, which is why no fastjson2 version is affected.

The operational problem is that there is nothing to patch. Imperva states that "FastJson 1.x is no longer actively maintained, and no patched 1.x version has been released for this vulnerability" ([Imperva, 2026-07-24](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/)), leaving three vendor-sanctioned routes: enable SafeMode, which rejects all `@type` input before the vulnerable path is reached; deploy the `1.2.83_noneautotype` build, which strips the vulnerable code at compile time; or migrate to fastjson2 ([Alibaba fastjson2 project, 2026-07-21](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)). Deployments that are not Spring Boot fat-JARs — uber-JARs and Tomcat or Jetty WAR deployments — do not meet the trigger condition, and fastjson 1.2.60 and earlier lack the vulnerable code path entirely (same advisory). Imperva reports attacks already in progress "across Financial Services, Healthcare, Computing, Retail, Business, and other industries", currently concentrated almost entirely on US-based organisations with a few in Singapore and Canada, and expects the targeting to expand globally; roughly 30 per cent of the attack traffic it sees comes from Ruby- and Go-based tooling rather than browser impersonators ([Imperva, 2026-07-24](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/)). The vulnerability was reported by Kirill Firsov of FearsOff Cybersecurity ([Alibaba fastjson2 project, 2026-07-21](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)).

Detection concepts, telemetry class first: in reverse-proxy, WAF and application access logs, surface JSON request bodies carrying `@type` or `@JSONType` keys against any endpoint that deserialises user input; in process-creation telemetry with parent lineage, alert on the JVM spawning a shell or downloader child; and in egress telemetry, look for outbound connections initiated by the Java process at the moment of type resolution, which is how the resource-probing path manifests when it reaches for an attacker-supplied class. The discriminator against benign traffic is configuration state rather than the marker itself — applications that deliberately use fastjson's polymorphic deserialisation also carry `@type` fields, so the signal is a `@type` value resolving to something outside the application's own allow-listed DTOs on an instance where SafeMode is off, not the presence of the key. Because the exposure is a library rather than a product, the hard part is inventory: fastjson 1.x is most likely to be present in Swiss and European estates as a transitive dependency inside a vendor-supplied Spring Boot artifact, where neither an asset inventory nor a national-CERT advisory will name it.