Alibaba's Fastjson 1.x Hit by Active RCE Exploits, No Patch

A remote code execution flaw in Alibaba's Fastjson library, reported by The Hacker News, is under active exploitation, and the awkward part is that there is no 1.x patch coming. CVE-2026-16723 carries a CVSS score of 9.0 and affects Fastjson versions 1.2.68 through 1.2.83 when deployed inside Spring Boot executable fat-JARs with SafeMode left at its disabled default.

The bug lives in the type-resolution machinery. A crafted `@type` value in a JSON request can be turned into a class-resource lookup, letting an attacker pull attacker-controlled bytecode from a nested JAR path inside compatible Spring Boot deployments. The `@JSONType` annotation on that resource then serves as a trust signal that lets the class walk past Fastjson's security checks. Kirill Firsov of FearsOff Cybersecurity responsibly disclosed the vulnerability; ThreatBook says it has seen in-the-wild exploitation after implementing detection support on July 22, 2026, and Imperva has documented attack activity across financial services, healthcare, computing and retail, primarily targeting United States-based organizations.

The ugly wrinkle for defenders is that 1.2.83 was the version many stacks were told to move to after a separate 2022 AutoType bypass. In other words, the release that a lot of teams patched forward to now sits at the top of the vulnerable range. Alibaba published its advisory on July 21, 2026 and, as of July 25, has not shipped a fixed 1.x build. Its guidance is to enable SafeMode with `-Dfastjson.parser.safeMode=true`, drop in the restricted `1.2.83_noneautotype` build, or migrate to Fastjson2, which the company says does not employ the vulnerable resource-probing mechanism.

The honest caveat is that the reporting does not name the threat actors, does not put a number on how many organizations have been hit, and does not commit Alibaba to any 1.x backport, so treat the exposure picture as the outlines of a live incident rather than a settled one. What is clear enough to act on is the shape of the fix: for anyone still running Fastjson 1.x behind a network-reachable JSON endpoint, the JVM flag is a today job and the Fastjson2 migration is a this-quarter one.