Critical Fastjson 1.x Flaw Under Active Attack With No Patch Available

A critical remote code execution vulnerability in Alibaba's Fastjson 1.x library is being actively exploited in the wild, with no patched version forthcoming for the affected branch.

Tracked as CVE-2026-16723, the flaw carries a CVSS score of 9.0 (Critical) and affects Fastjson versions 1.2.68 through 1.2.83 inclusive. Version 1.2.83 is the final release in the Fastjson 1.x branch; development has moved to Fastjson 2.x, leaving 1.x users without an official fix.

Gadget-Free Exploitation

Security firms Imperva and ThreatBook have confirmed active exploitation. Imperva reports attacks are currently focused almost entirely on US-based organizations, with additional incidents in Singapore and Canada.

The vulnerability is exceptionally dangerous because it operates under Fastjson's default configuration. According to Imperva Threat Research, "AutoType does not need to be enabled, and attackers do not need a suitable third-party gadget class to be present in the application's classpath."

This removes the typical prerequisites for JSON deserialization RCE attacks, making CVE-2026-16723 a "gadget-free" exploit that bypasses common hardening measures.

Spring Boot at Risk

Exploitation has been verified against Spring Boot applications deployed as executable fat-JARs across Spring Boot 2.x, 3.x, and 4.x, running on JDK versions 8, 11, 17, and 21. The attack vector exploits internal type-resolution logic and how Spring Boot fat-JARs handle class loading, specifically using @JSONType annotations as a trust signal to circumvent restrictions.

Chinese security firm Qi'anxin estimates that millions of systems worldwide are exposed.

No Patch Coming

Organizations using Fastjson 1.x face a difficult remediation path. Since no patched version will be released for the 1.x branch, affected teams must either implement manual mitigations such as enabling SafeMode or migrate to Fastjson 2.x, which may require significant code changes.

The vulnerability was disclosed on July 21, 2026, and was discovered by Kirill Firsov of FearsOff Cybersecurity. Multiple independent sources including NVD, GitHub Advisory, and Alibaba's official security advisory have confirmed the severity and scope.

Fastjson is a widely used Java library for JSON serialization and deserialization. Previous vulnerabilities typically relied on the AutoType feature or specific gadget classes in the application classpath. CVE-2026-16723 represents a significant shift in attack methodology, making it one of the most severe Fastjson vulnerabilities disclosed to date.