🔴 Active exploitation confirmed | CVSS 9.0 | No patch available for Fastjson 1.x
What is Fastjson?
Fastjson is a high-performance Java JSON library developed by Alibaba, and it is embedded in a surprisingly large portion of enterprise Java applications. Its deserialization features, once widely praised for speed, have become a persistent source of critical vulnerabilities. CVE-2026-16723 is the latest in a long line, and unlike recent predecessors it carries an unpatched status as of July 27, 2026.
The vulnerability
CVE-2026-16723 is a Java deserialization flaw in the Fastjson 1.x branch rated CVSS 9.0. An attacker who can send a crafted JSON payload to an endpoint using the Fastjson parser can trigger arbitrary class instantiation, which chains to remote code execution on the target server. The exploit does not require authentication at the application layer; it only requires that the endpoint accept and process JSON input through the affected library version.
Why no patch exists yet
Fastjson 1.x has been in maintenance-only mode for several years. The library's author, Alibaba, has pushed for migration to the newer fastjson2 branch, but the 1.x line remains in production across many enterprise and government deployments. Security researchers at Imperva and ThreatBook published joint findings on July 25 documenting active exploitation with no corresponding patch in the 1.x line. A backport fix is not expected.
Active exploitation in the wild
Imperva and ThreatBook observed exploitation attempts beginning around July 23. Observed payloads attempt to download and execute a second-stage loader from attacker-controlled infrastructure, with targets skewed toward Spring Boot applications exposing REST endpoints with default JSON processing configurations. The campaigns are opportunistic rather than targeted, suggesting broad scanning for vulnerable endpoints.
Who is exposed
Any application running Fastjson 1.x is potentially exposed if it processes attacker-supplied JSON. Spring Boot applications that included Fastjson as a JSON provider instead of Jackson are particularly at risk because the affected parsing path is exercised on nearly every request. Applications behind API gateways that validate JSON structure but do not sanitize class-loading gadgets remain vulnerable.
What to do right now
The immediate mitigation for applications that cannot migrate to fastjson2 is to enable SafeMode via ParserConfig.getGlobalInstance().setSafeMode(true). SafeMode disables autoType globally, breaking the deserialization gadget chains that CVE-2026-16723 relies on. The tradeoff is that any code relying on polymorphic deserialization must be refactored. For new projects and systems with engineering capacity, migration to fastjson2 is the durable fix. CISA has not added CVE-2026-16723 to the KEV catalog as of this writing, but active exploitation confirmed by two independent research teams makes rapid remediation essential regardless of FCEB status.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are assessing your Java application attack surface.