VTA-000191 – Critical Fastjson Flaw Enables Unauthenticated Remote Code Execution

Security researchers have observed active exploitation of a critical vulnerability, CVE-2026-16723 (CVSS 9.0), affecting Fastjson 1.2.68 through 1.2.83. The flaw allows unauthenticated remote code execution in vulnerable Spring Boot executable fat-JAR applications by sending a specially crafted JSON request to an exposed Fastjson parser.

The attack abuses Fastjson's type resolution mechanism, where a malicious @type value is manipulated into loading attacker-controlled resources. In affected Spring Boot fat-JAR deployments, the crafted payload can retrieve malicious bytecode and bypass Fastjson's type validation through annotation-based trust, ultimately executing code with the privileges of the running Java process. The attack does not require AutoType to be enabled or any classpath gadget, making exploitation significantly easier when SafeMode remains disabled.

The vulnerability affects applications that expose JSON parsing methods such as JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class), particularly when user-controlled data is deserialized into objects containing Object or Map fields.

Researchers reported observed exploitation attempts targeting multiple industries, including financial services, healthcare, retail, and technology sectors. While exploitation activity has been detected, there is currently no public evidence confirming successful compromise or large-scale breaches.

At the time of reporting, no patched Fastjson 1.x release was available. Organizations are advised to enable SafeMode, use the restricted 1.2.83_noneautotype build where migration is not immediately possible, and plan migration to Fastjson2, which is not affected by this vulnerability.

Severity:

Medium

Attack Surface:

Web Application, Endpoint

Tactics:

Initial Access, Execution, Privilege Escalation, Defense Evasion

Techniques:

T1190 – Exploitation for Client Execution

T1059 – Command and Scripting Interpreter

T1620 – Reflective Code Loading

T1105 – Ingress Tool Transfer

References:

1. https://nvd.nist.gov/vuln/detail/CVE-2026-16723

2. https://github.com/alibaba/fastjson2/wiki/Security-Advisory%3A-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83?utm_source=chatgpt.com

3. https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/

SuperPRO’s Threat Countermeasures Procedures:

1. Enable FastJson SafeMode using the JVM option -DFastJson.parser.safeMode=true

2. Migrate to FastJson 2.x after compatibility testing

3. Review application and WAF logs for suspicious JSON requests containing @type fields or jar:http and jar:file URL patterns

4. Inventory Java and Spring Boot applications for FastJson dependencies, including transitive dependencies

5. Use a FastJson noneautotype build to remove vulnerable AutoType-related code

6. Investigate potentially affected systems for unexpected process execution, outbound connections, unauthorized file changes, webshells, or other indications of compromise

Contributed by: Fatini