FastJson RCE CVE-2026-16723 Exploited in the Wild as Details and PoC Exploit Code Go Public
Do Son 
TL;DR
A critical FastJson RCE vulnerability, CVE-2026-16723, carries a CVSS score of 9.0. Full technical details and working proof-of-concept exploit code are now public. Imperva reports active exploitation in the wild against organizations across several industries.
- CVE: CVE-2026-16723
- CVSS: 9.0 (Critical · CVSSv3)
- Product: Alibaba Fastjson
- Affected: 1.2.68
- Impact: Remote Code Execution in fastjson 1.2.68–1.2.83
- Status: Exploited in the wild
- EPSS: 0.4% (30-day)
- Action: See vendor advisory
Why It Matters
FastJson is an open-source Java library from Alibaba. Developers use it to convert Java objects to JSON and back. It ships inside countless Spring Boot services, so the blast radius is wide.
This flaw is dangerous because it works under FastJson’s default configuration. AutoType does not need to be on. An attacker also needs no third-party gadget class in the classpath. As a result, the usual “remove the risky dependency” advice does not help here.
Qi’anxin, which tracks the bug as QVD-2026-43021, estimates millions of exposed instances. That scale, plus a public exploit, makes this a top-priority fix.
How the Attack Works
FastJson supports polymorphic deserialization through the @type field. That field names the Java class to build from incoming JSON. FastJson 1.x disables AutoType and applies checks to block untrusted classes. However, this flaw exposes an alternate path through the internal type-resolution logic.
An attacker submits crafted JSON with a malicious @type value. FastJson may then perform a resource lookup based on that attacker-controlled class name. In Spring Boot fat-JAR deployments, the attacker abuses nested JAR URLs to bypass the type restrictions and reach code execution. The library can also treat a @JSONType annotation as a trust signal, which widens the gap. The FearsOff research write-up documents the mechanism, and the maintainers cover it in their official FastJson security advisory.
Successful exploitation gives an unauthenticated remote attacker code execution with the application’s privileges. That can lead to data theft, webshells, credential compromise, or full server takeover. A public proof-of-concept lab already demonstrates the issue.
Exploitation status
Imperva reports that this FastJson RCE vulnerability is under active attack. Targets span financial services, healthcare, computing, retail, and more. Most activity hits US-based organizations, with some cases in Singapore and Canada.
Affected Versions
The bug affects FastJson 1.2.68 through 1.2.83, including the final 1.x release. FastJson maintainers verified exploitation in Spring Boot 2.x, 3.x, and 4.x, on JDK 8, 11, 17, and 21. FastJson 2.x is not affected, since its type resolution uses an allowlist-first model.
Patch and Mitigation Steps
FastJson 1.x is archived, so no patched 1.x release exists. Do not rely on perimeter defense alone.
First, enable SafeMode now with -DFastJson.parser.safeMode=true or the equivalent property. Alternatively, switch to a noneautotype build. Next, inventory your apps for FastJson dependencies, including transitive ones. Then plan a migration to FastJson 2.x after compatibility testing. Finally, review logs for JSON requests carrying @type fields or jar:http and jar:file URL patterns, and hunt for signs of compromise.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
