Active in the wild exploitation has been documented targeting an unpatched remote code execution vulnerability in a widely utilized Java JSON parsing library. The vulnerability allows unauthenticated remote attackers to pass crafted JSON queries to execute arbitrary commands inside the application execution environment.
The flaw, tracked as CVE-2026-16723 with a CVSS score of 9.0, impacts Alibaba Fastjson 1.x releases from version 1.2.68 through 1.2.83. The vulnerability resides within the type resolution path during JSON parsing routines. In compatible Spring Boot fat-JAR deployments, an attacker can submit a nested JSON request containing a manipulated type directive to trigger a class resource lookup and execute untrusted bytecode without requiring AutoType enablement or classpath gadgets. Because no vendor patch has been issued for Fastjson 1.x, security teams must enforce runtime SafeMode flags or upgrade to Fastjson2.
Subverting core parsing components inside Java enterprise web frameworks introduces severe initial access risks. Once an attacker achieves unauthenticated remote execution on an application server, they can harvest environment secrets, read internal database credentials, and launch lateral movement sweeps across internal cloud networks.
– Enable SafeMode immediately across all Fastjson 1.x deployments by passing the system property flag fastjson.parser.safeMode=true.
– Migrate legacy applications to the non-vulnerable Fastjson2 architecture as the permanent remediation path.
– Inspect web application firewall telemetry for anomalous JSON payloads containing type reference overrides.
– Restrict application server daemons to operate under strict least privilege account limits to contain potential process execution.
Application framework protection requires immediate implementation of runtime safety flags to guarantee that legacy JSON parsing engines do not serve as unmonitored execution vectors. #CodeDefence #Fastjson #Java #RCE #SpringBoot #AppSec #ZeroDay #VulnerabilityManagement
/
