Critical Remote Code Execution Flaw in Alibaba's Fastjson 1.x Exploited

Security firms ThreatBook and Imperva report active exploitation of a critical remote‑code‑execution vulnerability (CVE‑2026‑16723) in Alibaba’s Fastjson 1.x library, affecting versions 1.2.68 through 1.2.83. The flaw scores 9.0 on the CVSS scale and can be triggered in Spring Boot applications packaged as executable fat‑JARs, without needing AutoType enabled or any classpath gadget. Alibaba has not released a patch as of late July and advises customers to enable SafeMode (e.g., -Dfastjson.parser.safeMode=true) or use the variant fastjson:1.2.83_noneautotype, with a longer‑term migration to Fastjson2 recommended.

The Fastjson maintainers issued an advisory on 21 July, and the U.S. National Vulnerability Database added the CVE on 23 July. The vulnerability’s exploitation path relies on parsing malicious JSON that causes the library to load attacker‑controlled classes, potentially executing arbitrary code with the privileges of the Java process. Organizations unable to upgrade immediately are urged to adopt the short‑term mitigations while awaiting a formal fix.