Key Takeaways
- CVE‑2026-16723 is a critical (CVSS 9.0) deserialization flaw in Alibaba’s Fastjson 1.x library that allows unauthenticated remote code execution in Spring Boot fat‑JAR applications when SafeMode is disabled.
- The exploit chain works without enabling AutoType or requiring a classpath gadget; it hinges on a crafted
@typevalue that triggers a class‑resource lookup and loads attacker‑controlled bytecode from a nested JAR inside the Spring Boot executable. - Affected versions are Fastjson 1.2.68 through 1.2.83 (the latest 1.x release) when used with a Spring Boot fat‑JAR, JDK 8‑21, and SafeMode left at its default disabled state.
- Immediate mitigations: enable SafeMode (
-Dfastjson.parser.safeMode=true) or use the restricted buildcom.alibaba:fastjson:1.2.83_noneautotype; long‑term fix is migration to Fastjson 2, which does not contain the vulnerable code path. - ThreatBook and Imperva observed in‑the‑wild attempts, mainly via browser‑impersonator HTTP clients, but no public evidence of successful code execution or breaches has been released, and CISA’s ADP assessment currently marks exploitation as “none.”
Overview of CVE‑2026-16723 and Its Severity
CVE‑2026-16723 tracks a critical vulnerability in Fastjson, the popular JSON‑processing library maintained by Alibaba for Java applications. Assigned a CVSS score of 9.0 by Alibaba, the flaw permits unauthenticated attackers to achieve remote code execution (RCE) with the privileges of the Java process when certain conditions are met. The vulnerability was disclosed responsibly by Kirill Firsov of FearsOff Cybersecurity and subsequently published in an Alibaba security advisory on July 21, 2026. Its high score reflects the combination of low attack complexity, no required privileges, and the potential impact on confidentiality, integrity, and availability of affected services.
Affected Components and Prerequisites for Exploitation
The vulnerable code resides in Fastjson versions 1.2.68 through 1.2.83, inclusive. Exploitation requires a Spring Boot application packaged as an executable fat‑JAR (the “spring-boot-loader” format) that exposes a JSON‑parsing endpoint reachable from the network. Additionally, the JVM must be running with Fastjson’s SafeMode disabled—the default configuration—and the application must be using JDK 8, 11, 17, or 21. Notably, AutoType can remain disabled, and no classpath gadget is needed; the attack relies solely on the library’s type‑resolution mechanics and the structure of the Spring Boot fat‑JAR loader.
Technical Mechanism: Type‑Resolution and @type Abuse
Firsov’s analysis shows that the flaw originates in Fastjson’s type‑resolution pathway. When parsing a JSON string, the library interprets an @type field as a fully qualified class name. If SafeMode is off, Fastjson will attempt to load that class via its internal class‑loader. By supplying a specially crafted @type value that points to a resource inside a nested JAR (e.g., BOOT-INF/lib/evil.jar!com/example/Payload), an attacker can cause Fastjson to perform a class‑resource lookup. If the referenced resource contains a class annotated with @JSONType, Fastjson treats it as a trusted signal, bypasses its usual safety checks, and loads the attacker‑supplied bytecode into the JVM, thereby enabling arbitrary code execution.
Exploit Path in a Spring Boot Executable Fat‑JAR
In a Spring Boot fat‑JAR, application classes and dependencies are stored under BOOT-INF/classes and BOOT-INF/lib. The exploit leverages this layout: a malicious JSON request includes an @type that references a nested JAR file within BOOT-INF/lib. When Fastjson resolves the type, it extracts the bytecode from that nested JAR, interprets any @JSONType annotation as trustworthy, and defines the class in the running JVM. Because the Spring Boot loader already grants the application full privileges to read its own JAR entries, the attacker‑controlled class runs with the same rights as the Java process, allowing commands such as spawning a reverse shell or deploying a web shell.
Alternate JDK‑Specific Path via /proc/self/fd
Firsov also described a variant that works on newer JDK releases (8‑21) where the attacker‑controlled @type points to a file descriptor path like /proc/self/fd/<num>. By first causing the vulnerable application to download a remote JAR (e.g., via an external HTTP request) and then referencing the downloaded file through its file descriptor, the exploit bypasses the need for a pre‑existing nested JAR. This path demonstrates the flexibility of the flaw: as long as the attacker can get a bytecode payload into a location that the Java process can read as a file, Fastjson’s type‑resolution will load it, provided SafeMode remains disabled.
Mitigation Recommendations and Workarounds
Organizations unable to upgrade immediately should activate Fastjson’s SafeMode by setting the system property -Dfastjson.parser.safeMode=true or by using the restricted build com.alibaba:fastjson:1.2.83_noneautotype, which disables the vulnerable type‑resolution path. Alibaba’s official guidance emphasizes migration to Fastjson 2 as the long‑term solution, since the 2.x line does not implement the susceptible class‑resource lookup or annotation‑based trust mechanism. Additionally, security teams should verify that any Spring Boot deployments are not packaged as executable fat‑JARs if they must continue using Fastjson 1.x, or ensure that JSON‑parsing endpoints are tightly validated and restricted to trusted clients.
Vendor Observations: ThreatBook and Imperva Findings
ThreatBook reported that, after adding detection signatures on July 20, its platform captured in‑the‑wild exploitation attempts beginning July 22. Laboratory testing reproduced full RCE in a Spring Boot fat‑JAR on JDK 8, while an embedded Tomcat variant only achieved a remote JAR fetch or server‑side request forgery, indicating that the exploit’s success depends heavily on the exact deployment topology. Imperva observed malicious traffic targeting financial services, healthcare, computing, retail, and other sectors, primarily in the United States, with smaller volumes from Singapore and Canada. The majority of requests originated from browser‑impersonating HTTP clients; Ruby and Go‑based tools accounted for roughly 30% of the observed activity. Neither vendor released concrete exploit counts, raw request logs, or evidence of successful compromises.
Lack of Confirmed Exploitation Evidence and CISA Assessment
Despite the vendor reports, no public artifacts—such as payloads, execution traces, or named victims—have been published to confirm that the vulnerability has been leveraged to achieve actual code execution in production environments. A CISA‑ADP assessment dated July 23 classified exploitation as “none,” and The Hacker News confirmed on July 25 that CVE‑2026-16723 does not appear in the agency’s Known Exploited Vulnerabilities catalog. The discrepancy between observed attack attempts and the absence of verified successful exploits remains unexplained in the available sources, underscoring the need for continued monitoring and forensic analysis.
Migration to Fastjson 2 as the Long‑Term Fix
Fastjson 2 was deliberately redesigned to eliminate the vulnerable code path: it does not perform the class‑resource lookup triggered by @type, nor does it rely on annotation‑based trust signals. Consequently, applications using Fastjson 2 are immune to CVE‑2026-16723 regardless of SafeMode settings or deployment format. Alibaba advises organizations to prioritize upgrading to the latest Fastjson 2 release, conducting thorough dependency scans to identify both direct and transitive uses of the affected 1.x versions, and reviewing any custom deserialization logic for compatibility. Until migration is complete, enabling SafeMode or employing the noneautotype build remains the essential interim defense.