Security researchers are warning of widespread exploitation targeting a critical remote code execution (RCE) vulnerability in Alibaba’s Fastjson 1.x library. The flaw, tracked as CVE-2026-16723, is actively being leveraged by attackers across multiple industries, posing a significant risk to applications utilizing the vulnerable JSON parsing library. ThreatBook and Imperva have confirmed that malicious actors are attempting to exploit this vulnerability in real-world scenarios.
The vulnerability stems from unsafe deserialization logic within Fastjson’s type resolution mechanism, specifically related to the ‘AutoType’ feature. Attackers can craft malicious JSON requests containing a specially constructed @type attribute which triggers remote code execution. Notably, this exploitation can occur without authentication and grants attackers privileges equivalent to that of the Java process running the vulnerable application. This makes it exceptionally dangerous as an attacker could potentially gain control over sensitive systems and data.
CVE-2026-16723 impacts Fastjson versions 1.2.68 through 1.2.83. The vulnerability is easily exploitable under default SafeMode configuration, even without a gadget class present on the classpath. According to researchers, a malicious JSON payload can be sent to a vulnerable application and executed without any authentication required, allowing an attacker to gain complete control over the Java process.
Compounding the severity of this issue is the fact that Alibaba has not released a fixed version of Fastjson 1.x. While workarounds exist, organizations are left with limited options for immediate remediation. This situation demands careful consideration and implementation of alternative parsing libraries or mitigation strategies to protect against potential attacks. The lack of an official patch further elevates the risk profile associated with using vulnerable versions of Fastjson.
Security advisories were initially published by Alibaba following responsible disclosure on July 21st. However, as of July 25th, a fixed version remains unavailable, leaving organizations exposed to ongoing exploitation attempts. Organizations should consider implementing mitigations such as input validation and restricting network access to vulnerable applications until a patch is released.
Sources: