Critical Vulnerability in FastJson: How to Protect Java Applications

Critical Vulnerability in FastJson: Remote Code Execution Risk

On July 21, 2026, the maintainers of FastJson issued a security advisory regarding a critical remote code execution vulnerability in the FastJson library, widely used for JSON data processing in Java. The vulnerability, identified as CVE-2026-16723 and with a CVSS score of 9.0 (Critical), affects FastJson versions between 1.2.68 and 1.2.83, inclusive, the latest version of the 1.x branch.

The vulnerability was discovered by FearsOff Cybersecurity and can be exploited without requiring authentication, enabling AutoType, or relying on third-party gadget classes. This makes it particularly dangerous as it is exploitable with FastJson's default configuration.

Technical Details and Exploitation Methods

FastJson supports polymorphic deserialization through the @type field, which identifies the Java class to instantiate from the provided JSON data. Although FastJson 1.x disables AutoType by default and applies checks to prevent the instantiation of untrusted classes, the new vulnerability exploits an alternative path through the internal type resolution logic.

An attacker can send specially crafted JSON containing a malicious @type value. During processing, FastJson can perform resource lookups based on the class name controlled by the attacker. In Spring Boot distributions like fat JARs, an attacker can manipulate this behavior using nested JAR URLs, bypass normal FastJson type restrictions, and achieve a code execution path without providing a conventional deserialization gadget.

This bypass is possible because FastJson 1.x can treat the presence of a @JSONType annotation as a trust signal during type resolution. The attacker-controlled resource lookup and annotation-based trust behavior combine to evade protections normally associated with AutoType disabling.

Impact and Attack Scenarios

Successful exploitation of the vulnerability can allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the affected Java application. This could lead to data theft, malware distribution or webshell, credential compromise, lateral movement, or complete takeover of the underlying server.

Currently, attacks exploiting this vulnerability are targeting a wide range of organizations in sectors such as Financial Services, Healthcare, Computing, Retail, and Business, primarily in the United States, with some attacks reported in Singapore and Canada as well.

Most of the attacks originate from impersonated browsers, although tools written in Ruby and Go represent about 30% of all attacks collectively.

Mitigation and Protection Measures

Imperva customers are protected from exploitation attempts associated with CVE-2026-16723. The Imperva Threat Research team has added detection and protection capabilities for this vulnerability to Imperva Web Application Firewall (WAF) and Imperva Server Protection (formerly Incapsula).

Imperva recommends the following additional steps to mitigate the risk:

• Upgrade to FastJson 2.x, which includes fixes for this vulnerability.
• Implement network segmentation to limit the exposure of affected systems.
• Monitor for any unusual activity or attempts to exploit this vulnerability.

Organizations using FastJson 1.x should prioritize upgrading to the latest version of FastJson 2.x to mitigate this vulnerability.