Fastjson CVE-2026-16723 exploited, no patch: check your deps

There is a class of vulnerability that no amount of patch discipline saves you from: the one with no patch. Fastjson CVE-2026-16723 is that one this week. It's an unauthenticated remote code execution flaw in a JSON library that thousands of Java shops pulled in years ago and never thought about again, it's being exploited right now, and as of today Alibaba has not shipped a fixed 1.x release.

What actually happened

Alibaba published a security advisory on July 21 after responsible disclosure from Kirill Firsov of FearsOff, covering Fastjson 1.2.68 through 1.2.83 with an Alibaba-assigned CVSS 9.0. The Hacker News reported that threat intel firm ThreatBook observed in-the-wild exploitation a day later, on July 22.

The mechanics matter because they break the assumptions most teams have about Fastjson risk. Every previous Fastjson RCE story came down to AutoType and gadget chains, so the received wisdom was "AutoType is off, we're fine." Not here. An attacker-controlled @type value gets turned into a class-resource lookup that can pull bytecode out of a crafted nested JAR path. AutoType can stay disabled. No classpath gadget is needed. What you need for the chain to work is Fastjson 1.2.68–1.2.83, a Spring Boot executable fat-JAR deployment, an endpoint that parses attacker-supplied JSON, and SafeMode off — which is the default.

Two mitigations exist today: enable SafeMode with -Dfastjson.parser.safeMode=true, or swap to the com.alibaba:fastjson:1.2.83_noneautotype build. The long-term fix Alibaba points at is migrating to Fastjson2, which isn't affected.

Why this matters for your business

You probably don't know whether you run Fastjson, and that's the actual finding here. It's a transitive dependency in a lot of Java tooling — vendor middleware, an integration connector, a reporting service someone stood up in 2021. The Java service quietly moving orders between your ERP and your storefront is exactly the kind of thing nobody has opened in three years.

So do the boring thing first. Run mvn dependency:tree | grep fastjson or ./gradlew dependencies | grep fastjson against every Java build you own, including the ones you inherited. If a version in the 1.2.68–1.2.83 range shows up on a service that parses JSON from anywhere other than your own network, set the SafeMode flag today and schedule the Fastjson2 migration for this sprint. Don't wait for the patched release — there's no public date for one, and CVE-2026-16723 isn't in CISA's KEV catalog yet either, so nothing external is going to nag you into it.

The broader lesson we keep relearning with clients: a software bill of materials you can query in five minutes is worth more than any single patch. When the next no-patch CVE lands, the question is never "is it bad." It's "do we have it," and most teams can't answer that in under a week.

Sources: Alibaba Security Advisory, The Hacker News.