Executive Summary
A critical remote code execution (RCE) vulnerability has been discovered in the widely used Fastjson 1.x library, developed by Alibaba. This vulnerability, which currently has no available patch, is being actively targeted in the wild. The flaw enables unauthenticated attackers to execute arbitrary code on affected systems, specifically those running Spring Boot applications packaged as executable fat-JARs and utilizing Fastjson versions 1.2.68 through 1.2.83. The exploitation of this vulnerability can lead to full system compromise, data exfiltration, and lateral movement within enterprise environments. Multiple security vendors, including ThreatBook and Imperva, have confirmed exploitation attempts, although no public disclosures of successful breaches have been made. Given the absence of a vendor patch and the ease of exploitation, this vulnerability represents a severe risk to organizations relying on affected versions of Fastjson.
Threat Actor Profile
The exploitation of the Fastjson 1.x RCE vulnerability has attracted a diverse set of threat actors, ranging from opportunistic cybercriminals to more sophisticated adversaries. Analysis of attack telemetry indicates that the majority of exploitation attempts originate from automated scanning infrastructure, leveraging browser impersonation and scripting tools such as Ruby and Go-based frameworks. While there is no current attribution to specific advanced persistent threat (APT) groups, the technical sophistication of the exploit chain and the targeting of high-value sectors suggest that both financially motivated actors and state-sponsored groups may seek to weaponize this vulnerability. The attack surface is particularly attractive due to the prevalence of Fastjson in enterprise Java applications and the lack of a vendor-supplied fix.
Technical Analysis of Malware/TTPs
The Fastjson 1.x RCE vulnerability (tracked as CVE-2026-16723 in some advisories) arises from unsafe deserialization logic in the library’s type resolution mechanism. Attackers craft malicious JSON payloads containing a specially constructed @type attribute. When this payload is processed by a vulnerable endpoint, Fastjson attempts to resolve the specified class type, which, in the context of a Spring Boot fat-JAR, can trigger the loading of attacker-controlled bytecode from nested JAR resources.
The exploitation chain does not require the traditional AutoType enablement or classpath gadget presence, making it more broadly exploitable than previous Fastjson deserialization flaws. The attack is viable when the following conditions are met: the application uses Fastjson 1.2.68–1.2.83, is packaged as a Spring Boot executable fat-JAR, has SafeMode disabled (the default), and exposes a network-accessible endpoint that parses attacker-supplied JSON. Entry points include JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Notably, binding input to a fixed class does not mitigate the risk if the object contains fields of type Object or Map.
Upon successful exploitation, the attacker achieves arbitrary code execution with the privileges of the Java process. This can be leveraged to deploy web shells, establish persistence, exfiltrate sensitive data, or pivot deeper into the network. Indicators of compromise include suspicious @type values in logs, nested JAR URLs in requests, unexpected outbound connections from Java processes, and evidence of new child processes or file modifications.
Exploitation in the Wild
Active exploitation of the Fastjson 1.x RCE vulnerability has been observed since at least July 2026. ThreatBook reported in-the-wild exploitation attempts, with successful code execution demonstrated in laboratory conditions on Spring Boot fat-JAR deployments running JDK 8. Imperva has detected exploitation attempts targeting organizations in the financial, healthcare, computing, and retail sectors, predominantly in the United States, with additional activity in Singapore and Canada. Attackers are using a mix of browser impersonation and scripting tools, with approximately 30% of observed requests originating from Ruby and Go-based automation.
Despite widespread scanning and exploitation attempts, there have been no public disclosures of successful breaches or named victims as of this report. The Cybersecurity and Infrastructure Security Agency (CISA) has not yet added this vulnerability to its Known Exploited Vulnerabilities catalog, and exploitation is currently marked as "none" in CISA-ADP. However, the rapid weaponization and public availability of proof-of-concept (PoC) code significantly elevate the risk profile.
Victimology and Targeting
The primary targets of Fastjson 1.x RCE exploitation attempts are organizations operating in sectors with high-value data and critical infrastructure, including financial services, healthcare, computing, and retail. Geographically, the United States has seen the highest volume of attack traffic, followed by Singapore and Canada. The attack surface is defined by the presence of vulnerable Spring Boot fat-JAR applications that utilize affected versions of Fastjson. Organizations with externally exposed APIs or web services that process untrusted JSON input are at greatest risk. The lack of a patch and the ease of exploitation make this vulnerability particularly attractive to both opportunistic and targeted attackers.
Mitigation and Countermeasures
Given the absence of a patched version for Fastjson 1.x, organizations must take immediate action to mitigate risk. The following countermeasures are strongly recommended:
Enabling SafeMode is the most effective immediate mitigation. This can be achieved by setting the JVM option -Dfastjson.parser.safeMode=true, configuring ParserConfig.getGlobalInstance().setSafeMode(true) in application code, or specifying the setting in fastjson.properties. SafeMode disables the vulnerable type resolution pathway and prevents exploitation.
Where migration is not immediately feasible, organizations should deploy the restricted build com.alibaba:fastjson:1.2.83_noneautotype, which disables dangerous deserialization features.
The long-term solution is to migrate to Fastjson2, which is not affected by this vulnerability and incorporates significant security improvements.
A comprehensive inventory and audit of all direct and transitive Fastjson dependencies should be conducted. Security teams should review application logs for suspicious @type values, nested JAR URLs, and anomalous Java process behavior. Network monitoring should be implemented to detect unexpected outbound connections from Java applications.
Where possible, restrict network access to endpoints that process JSON input, and implement strict input validation to reject untrusted or malformed payloads.
References
The Hacker News: Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available, SecurityOnline.info: Public PoC for fastjson 1.2.83 RCE, Knownsec 404 Team: Fastjson Deserialization Vulnerability History, Alibaba Security Advisory, NVD - CVE-2026-16723 (pending publication), ThreatBook: Fastjson RCE (≤1.2.83): Active Exploitation Detected
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their supply chain and digital ecosystem. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, prioritize remediation, and ensure compliance with industry standards. For more information about how Rescana can help secure your organization, or for any questions regarding this advisory, please contact us at info@rescana.com.
