A remote code execution

CVE-2026-16723 is a remote code execution vulnerability in Alibaba's fastjson library, versions 1.2.68 through 1.2.83. The flaw abuses the @JSONType annotation probe in fastjson's ParserConfig.checkAutoType method: when an application is packaged as a Spring Boot executable fat-JAR, the framework's LaunchedURLClassLoader will follow attacker-supplied jar:http:// URLs during class resolution, fetching and executing remote bytecode. Critically, this works with AutoType *disabled* and requires no gadget chain — the annotation probe itself is the trust bypass. On JDK 8, exploitation yields direct code execution; on JDK 17–21 on Linux, attackers use a retained file-descriptor technique via /proc/self/fd/N to achieve the same outcome. WAR deployments and shade/assembly uber-JARs are not affected. Fastjson2 is architecturally immune.

Alibaba's CRITICAL / 9.0 rating is warranted and arguably conservative given current conditions. The CVSS vector already bakes in AC:H for the Spring Boot fat-JAR prerequisite, but the vendor score does *not* reflect the zero-day dimension: as of July 27, there is no patched 1.x release. ThreatBook and Imperva have independently confirmed in-the-wild exploitation targeting US financial services, healthcare, and retail sectors. A public PoC lab with Docker environment (dinosn/fastjson-jsontype-rce-lab) and a second PoC (seklure/fastjson-jsontype-rce-poc) are freely available. The combination of active exploitation, public weaponized code, and no vendor patch makes this a textbook zero-day emergency for any team running fastjson 1.x in Spring Boot fat-JARs.

Why this verdict

• Active zero-day exploitation overrides friction discounts. ThreatBook and Imperva have independently confirmed in-the-wild exploitation as of July 22–25. When attackers are already successfully landing the chain, theoretical friction arguments lose weight — the AC:H bar is being cleared in production.
• No vendor patch exists. Fastjson 1.x has no fixed release. The only mitigations are SafeMode (a JVM flag requiring restart) or migration to fastjson2 (a library swap requiring code changes and testing). This extends the exposure window indefinitely and makes the zero-day designation accurate.
• Public weaponized PoC lowers the bar to commodity exploitation. The dinosn/fastjson-jsontype-rce-lab repo provides a Docker environment, a one-command exploit, and defensive scanners — everything a script-kiddie or automated scanner needs. A second independent PoC exists at seklure/fastjson-jsontype-rce-poc.
• Unauthenticated, no user interaction, scope change. The CVSS vector reflects genuine severity: any JSON endpoint reachable over the network is a valid entry point. No credentials, no phishing, no insider access needed.
• Role multiplier: Fastjson is a general-purpose Java library, not canonically a high-value-role component. However, in enterprises with Chinese tech stack influence (Alibaba Cloud, Ant Group ecosystem, DingTalk integrations), fastjson 1.x is embedded in API gateways, payment processing services, and identity federation layers. In these deployments, the blast radius extends from host compromise to credential harvesting and lateral movement toward domain-level assets. For organizations where fastjson backs a customer-facing API gateway or payment tier (~10–20% of the fastjson 1.x installed base in APAC enterprises), the chain ends in mass data exposure — this floors the verdict at HIGH and the zero-day + active exploitation factors push it to CRITICAL.

Why not higher?

The vendor already rates this 9.0 CRITICAL, the maximum reasonable score given AC:H. A 10.0 would require AC:L (trivially exploitable against any deployment), but the Spring Boot fat-JAR requirement, outbound HTTP dependency, and JDK-version-dependent chain variants genuinely narrow the exploitable population. The CVSS vector is honest about this complexity.

Why not lower?

Downgrading below CRITICAL is unjustifiable when active exploitation is confirmed, no patch exists, and public PoC code is weaponized. The Spring Boot fat-JAR constraint is the only major friction point, but (a) fat-JAR is the dominant Spring Boot packaging model, (b) the vendor already priced this into AC:H, and (c) attackers are demonstrably clearing this bar in production. Dropping to HIGH would understate the urgency of a zero-day with no fix.

1. Enable SafeMode immediately on all fastjson 1.x instances — Add -Dfastjson.parser.safeMode=true to JVM startup flags or call ParserConfig.getGlobalInstance().setSafeMode(true) at application init. This disables all type-resolution probing and closes the attack vector entirely. Requires application restart. Per noisgate mitigation SLA for CRITICAL, deploy within 3 days.
2. Switch to the noneautotype build variant — Replace com.alibaba:fastjson:1.2.83 with com.alibaba:fastjson:1.2.83_noneautotype in your Maven/Gradle build. This is a drop-in replacement that strips the vulnerable code path. Requires rebuild and redeploy. Deploy within 3 days per noisgate mitigation SLA.
3. Block outbound HTTP/HTTPS from application servers — The exploit requires the target JVM to fetch a remote JAR. Egress filtering at the firewall or proxy level that denies direct outbound HTTP from app-tier hosts breaks the chain. This is defense-in-depth — it stops the payload fetch even if SafeMode is not yet enabled. Deploy within 3 days.
4. Deploy WAF rules blocking @type in JSON bodies — Imperva has confirmed their WAF detects malicious @type values, nested JAR URL patterns, and RCE techniques. If you run a WAF (Imperva, Cloudflare, AWS WAF), enable or create rules to inspect JSON request bodies for @type keys containing jar: URLs. This is a detection layer, not a fix. Deploy within 3 days.
5. Migrate to fastjson2 — Fastjson2 is architecturally immune — no resource probing, no annotation-based trust bypass, allowlist-first type resolution. This is the permanent remediation. Plan and execute migration within the 90-day noisgate remediation SLA for CRITICAL.

Run this script on each application host suspected of running fastjson 1.x. It checks deployed Spring Boot fat-JARs for vulnerable fastjson versions and SafeMode status. Execute as the application service account or root: bash check_fastjson_cve2026_16723.sh /opt/myapp/app.jar

#!/usr/bin/env bash
# check_fastjson_cve2026_16723.sh — CVE-2026-16723 exposure check
# Usage: bash check_fastjson_cve2026_16723.sh <path-to-spring-boot-jar>
# Exit codes: 0=PATCHED/SAFE, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

JAR="${1:-}"
if [[ -z "$JAR" || ! -f "$JAR" ]]; then
  echo "Usage: $0 <path-to-spring-boot-jar>"
  echo "UNKNOWN — no JAR file specified or file not found"
  exit 2
fi

# Check if this is a Spring Boot fat-JAR (contains BOOT-INF/)
if ! unzip -l "$JAR" 2>/dev/null | grep -q 'BOOT-INF/'; then
  echo "PATCHED — not a Spring Boot fat-JAR (WAR/shade/assembly packaging is not affected)"
  exit 0
fi

# Look for fastjson 1.x in BOOT-INF/lib/
FJ_JARS=$(unzip -l "$JAR" 2>/dev/null | grep -oP 'BOOT-INF/lib/fastjson-1\.[0-9.]+[^/]*\.jar' || true)

if [[ -z "$FJ_JARS" ]]; then
  echo "PATCHED — no fastjson 1.x found in fat-JAR dependencies"
  exit 0
fi

# Check if the noneautotype variant is in use
if echo "$FJ_JARS" | grep -q 'noneautotype'; then
  echo "PATCHED — fastjson 1.2.83_noneautotype variant detected (not vulnerable)"
  exit 0
fi

# Extract version number and check range
VULN=0
for fj in $FJ_JARS; do
  VER=$(echo "$fj" | grep -oP '1\.2\.\K[0-9]+')
  if [[ -n "$VER" ]] && [[ "$VER" -ge 68 ]] && [[ "$VER" -le 83 ]]; then
    echo "[!] Vulnerable fastjson found: $fj (version 1.2.$VER in range 1.2.68–1.2.83)"
    VULN=1
  fi
done

if [[ "$VULN" -eq 0 ]]; then
  echo "PATCHED — fastjson version outside vulnerable range"
  exit 0
fi

# Check for SafeMode in running JVM processes
JAR_BASENAME=$(basename "$JAR")
SAFEMODE_ON=0
if ps aux 2>/dev/null | grep -v grep | grep "$JAR_BASENAME" | grep -q 'fastjson.parser.safeMode=true'; then
  SAFEMODE_ON=1
fi

if [[ "$SAFEMODE_ON" -eq 1 ]]; then
  echo "PATCHED — vulnerable fastjson version present but SafeMode is ENABLED (mitigated)"
  exit 0
fi

# Check JDK version for context
JAVA_VER=$(java -version 2>&1 | head -1 || echo 'unknown')
echo "[!] JDK: $JAVA_VER"
echo "[!] SafeMode: NOT enabled (default=disabled)"
echo "VULNERABLE — CVE-2026-16723: fastjson 1.x RCE in Spring Boot fat-JAR with SafeMode disabled"
exit 1

Sources

1. Alibaba Security Advisory — fastjson 1.2.68–1.2.83 RCE
2. The Hacker News — Fastjson 1.x RCE Targeted in Attacks
3. Imperva — CVE-2026-16723 Protection Analysis
4. SecurityOnline — Public PoC Released for fastjson 1.2.83 RCE
5. FearsOff Research — FastJson 1.2.83 RCE
6. dinosn/fastjson-jsontype-rce-lab — Docker PoC + Scanner
7. Latest Hacking News — How to Check Fastjson Exposure