Fastjson 1.x RCE Exploited: No Patch Available
Fastjson 1.x (CVE-2026-16723, CVSS 9.0) is under active attack. No patch exists. An unauthenticated JSON request runs code as the Java process.
airgap Exploitation confirmed. ThreatBook and Imperva report active attacks against CVE-2026-16723, a critical unauthenticated remote code execution flaw in Fastjson 1.x — Alibaba’s JSON parsing library for Java.
No patch available. Alibaba has not issued a fix for the 1.x branch. This is not a patching delay. It is the current state.
What is confirmed
Affected: Spring Boot applications running Fastjson 1.x that accept untrusted JSON input. A crafted JSON request executes arbitrary code without authentication, running with the privileges of the Java process. CVSS 9.0, Alibaba-assigned. NVD entry: CVE-2026-16723.
Active exploitation: confirmed. ThreatBook and Imperva are tracking attack traffic as of July 25, 2026. Attribution: unconfirmed — treat accordingly. Not yet on CISA KEV at time of writing.
Immediate action — in order
-
Inventory. Find every Spring Boot application in your stack that uses Fastjson 1.x and accepts JSON from an untrusted source: public-facing API endpoints, user-submitted data, webhook handlers. If you don’t know which services use it, check your dependency manifests now.
-
Restrict deserialization at the boundary. While no vendor fix exists, enforcing strict allowlists on deserialized class types limits exposure. Treat untrusted JSON input as hostile.
-
Consider migration. The Fastjson 1.x branch has a documented history of deserialization vulnerabilities; this is not an isolated incident. Fastjson2 was architected to address these weaknesses. Jackson and Gson are also widely deployed alternatives. Migration is not a one-day task, but the calculus has shifted: there is no vendor patch coming for 1.x.
-
Watch the KEV catalog. Confirmed exploitation with no available fix is a strong indicator for a CISA KEV addition — monitor for CVE-2026-16723. A KEV listing triggers mandatory remediation timelines for federal civilian agencies. The urgency applies regardless of whether your organization is federal.
Fastjson 1.x in production right now: this is not a schedule-it-for-next-quarter situation.
Source: The Hacker News, July 25, 2026
- [ CRITICAL ] CVE-2026-16723 Fastjson 1.x unauthenticated RCE in Spring Boot applications
Found this useful? Share it.
