CVE-2026-16723 exposes code execution in Spring Boot by Fastjson in fat-JAR

A critical failure in the Fastjson library of Alibaba - registered as CVE-2026-16723- re-alert Java developers and security teams: attackers can achieve code execution in packaged Spring Boot applications like Fat-JAR simply by sending a malicious JSON request, and exploitation materializes with the privileges of vulnerable Java process.

The confirmed chain of operation requires several specific conditions: an affected version of Fastjson in the range 1.2.68 to 1.2.83, a Spring Boot application distributed as an executable fat-JAR, a network route that accepts JSON controlled by the attacker and that Fastjson runs with its SafeMode disabled(which is the default behavior in many installations). It is important to stress that AutoType can remain disabled and that no gadget is required in the traditional classpath; the technique takes advantage of the type resolution and Fastjson's ability to convert a value @ type into a resource search that, in a fat-JAR, can target a nested JAR with bytecode controlled by the attacker.

Researchers who worked the case, including Kirill Firsov of FearsOff, described two exploitation routes: the classic one that uses the resource route within a fat-JAR and a variant that in more recent JDKS downloads a remote JAR and the reference via / proc / self / fd. Fastjson's maintainers verified the chain in Spring Boot 2.x, 3.x and 4.x over JDK 8, 11, 17 and 21, which extends the scope of the possible area affected.

As for the activity observed, companies such as ThreatBook and Imperva reported detection of exploitation attempts in nature, with Imperva pointing to campaigns targeting sectors such as finance and health mainly in the US. United States and additional detections in Singapore and Canada. However, the reports do not publicly document verified cases of remote code execution with impact on specific victims; the CISA Agency, in its preliminary assessment, marked the operation as none in terms of confirmation. The fact that there is an activity of exploration or attempted exploitation does not necessarily imply massive commitments, but does raise the priority of the response.

For equipment in need of immediate action, there are clear and rapidly applicable technical measures: Enable SafeMode in Fastjson launching the JVM with -Dfastjson.parser.safeMode = true, or using the restricted device published as com.alibaba: fastjson: 1.2.83 _ noneautotype as long as there is no official 1.x patch. Alibaba has recommended as a long-term solution the migration to Fastjson2, which does not use the same resource resolution route and is therefore not affected by this vector.

It is not enough to trust that binding to a fixed class will protect from everything: if the target class contains fields of type Object or Map, the payload can nesting there and shoot the operating chain. For this reason, in addition to patches and configurations, teams must make a comprehensive inventory of direct and transitional units to locate Fastjson artifacts in applications and libraries, review packaged deployments such as fat-JAR and prioritize their reconstruction such as flat JARS, WAR or deployments in containers that avoid Spring Boot's fat-JAR charger.

In detection and response, you need to search for concrete indicator artifacts: suspicious @ type values in JSON input logs, nested URLs to JARS in input fields, unexpected outgoing connections that download JARS, creation of child processes by Java service, file changes or web shells. In-depth defenses - Internet output filtering, WAF rules to block @ type and Nested JAR patterns, Java process limits and sandboxing, and EDR / CSIRT monitoring - reduce the exposure window if an attempt is successful.

If it is not possible to migrate immediately to Fastjson2 or to rebuild artifacts, adopt an immediate border control policy: it restricts which hosts can receive applications to JSON endpoints, apply specific WAF rules, increase the level of JSON parser login and set up alerts for abuse patterns. In the medium term, plan to replace fat-JARS with packages that do not depend on the Spring Boot special charger, audit third-party libraries to avoid vulnerable transitional dependencies and test the CI / CD pipelines to block affected versions.

Finally, document and share findings in your organization: record versions of Fastjson detected, evidence of malicious requests and mitigation measures applied; this will facilitate subsequent audits and prioritizing patches. For official information on the project and follow-up of versions, see the Fastjson repository in GitHub at https: / / github.com / alibaba / fastjson and the warnings and vulnerability lists held by agencies such as CISA in https: / / www.cisa.gov / knowledge-exploited-vulnerabilities-catalog. For analysis and alerts from actors who have observed activity, see the pages of suppliers who published findings, for example Imperva and ThiratBook.