- A critical remote code execution vulnerability (CVE-2026-16723, CVSS 9.0) affects Alibaba’s Fastjson library versions 1.2.68 through 1.2.83 when used in Spring Boot applications.
- Security firms ThreatBook and Imperva report active exploitation targeting financial services, healthcare, and other sectors, primarily in the United States.
- No patched Fastjson 1.x version is available as of July 25; organizations should enable SafeMode or use the restricted build, while Alibaba recommends migrating to Fastjson2.
- The exploit requires a Spring Boot fat-JAR and attacker-controlled JSON input but does not need AutoType enablement or a classpath gadget.
On July 25, 2026, security researchers disclosed a critical remote code execution vulnerability in Alibaba‘s Fastjson JSON library that can compromise Spring Boot applications without authentication. Tracked as CVE-2026-16723, the flaw carries a CVSS score of 9.0 and affects Fastjson 1.2.68 through 1.2.83.
According to Alibaba’s advisory, the attack chain requires no AutoType enablement and no classpath gadget. The vulnerability was discovered by Kirill Firsov of FearsOff Cybersecurity, who traced the issue to Fastjson’s type-resolution path.
An attacker-controlled @type value can be turned into a class-resource lookup within a Spring Boot fat-JAR, allowing crafted bytecode to be loaded. Firsov’s technical analysis also describes a newer-JDK path that downloads a remote JAR via /proc/self/fd.
ThreatBook reported in-the-wild exploitation after adding detection support, reproducing full code execution on JDK 8. Imperva detected activity against financial services, healthcare, and retail organizations, primarily in the United States, with browser impersonators generating most requests.
Despite these reports, a CISA-ADP assessment marked exploitation as none, and the flaw is absent from CISA’s Known Exploited Vulnerabilities catalog. No patched Fastjson 1.x artifact exists on GitHub or Maven Central as of July 25.
Organizations should enable SafeMode with -Dfastjson.parser.safeMode=true or use the restricted 1.2.83_noneautotype build. Alibaba lists migration to Fastjson2 as the long-term fix.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Micron Stock Split 2026? Odds Rise as MU Tops $900
- North Korea arrests crypto laundering bank hackers
- Morgan Stanley hikes Apple stock target to $364, sees 13% ROI
- Peter Schiff warns Bitcoin break below $50,000 could trigger crash to $20,000
- US Spot Ethereum ETFs See $70.6M Outflow, Ending 5-Day Inflow Streak
