A significant security vulnerability has been identified in Fastjson, a JSON library for Java developed by Alibaba. Security firms ThreatBook and Imperva report that this flaw is being actively targeted by attackers.
Details of the Vulnerability
The vulnerability, tracked as CVE-2026-16723, has been assigned a CVSS score of 9.0, indicating its critical nature. It affects Fastjson versions 1.2.68 through 1.2.83, particularly in Spring Boot applications. Attackers can exploit this flaw by sending a malicious JSON request that executes code without authentication, using the privileges of the Java process.
Conditions for Exploitation
The confirmed exploitation chain requires several specific conditions: the use of a Spring Boot executable fat-JAR, a network-accessible path that transmits attacker-controlled JSON to the affected parser, and the default disabled state of SafeMode. Notably, the exploit does not require AutoType to be enabled, nor does it necessitate a classpath gadget.
Current Status and Mitigation
As of July 25, 2026, Alibaba has not released a patched version of Fastjson 1.x. Organizations unable to migrate immediately are advised to enable SafeMode by setting -Dfastjson.parser.safeMode=true or to utilize com.alibaba:fastjson:1.2.83_noneautotype. Alibaba recommends migrating to Fastjson2 as a long-term solution, as it is not affected by this vulnerability.
Exploitation Observed
ThreatBook reported that it had detected in-the-wild exploitation of this vulnerability shortly after adding detection capabilities. Their laboratory tests confirmed full code execution in a Spring Boot fat-JAR on JDK 8, while other tests indicated only partial exploitation. Imperva noted that various sectors, including financial services and healthcare, are being targeted, primarily in the United States, with lesser activity reported in Singapore and Canada.
Despite these reports, neither vendor has published specific numbers regarding attack counts or confirmed compromises. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) assessed the exploitation status as none, although the reasons for this discrepancy remain unclear. As of the latest updates, there is no patched Fastjson 1.x artifact available in the project’s GitHub or Maven Central repositories.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
