Affected Systems
Alibaba Fastjson versions 1.2.68 through 1.2.83 in Spring Boot executable fat-JAR deployments. Requires network-reachable JSON parsing endpoint and default SafeMode disabled. Plain JARs, generic uber-JARs, and WAR deployments are not affected.
Exploitation Status
Active exploitation confirmed by ThreatBook and Imperva since at least July 20, 2026. Attacks observed against financial services, healthcare, computing, and retail sectors, primarily in the United States. Public PoC available from researcher Kirill Firsov. CISA has not yet added to KEV catalog despite confirmed in-the-wild activity.
Business Impact
Unauthenticated remote code execution with Java process privileges in affected Spring Boot applications. Attacker can execute arbitrary code via crafted JSON request exploiting Fastjson's type-resolution path and Spring Boot fat-JAR loader. No patch available for Fastjson 1.x; Alibaba recommends migration to Fastjson2. Organizations using Fastjson 1.2.68–1.2.83 in Spring Boot fat-JARs face immediate risk with only workarounds available.
Urgency
🔴 Immediate
Recommended Actions
- Inventory all direct and transitive Fastjson dependencies across Java applications; prioritize Spring Boot fat-JAR deployments running Fastjson 1.2.68 through 1.2.83
- Enable SafeMode immediately with JVM flag -Dfastjson.parser.safeMode=true or switch to com.alibaba:fastjson:1.2.83_noneautotype artifact as temporary mitigation
- Monitor affected systems for indicators of compromise: suspicious @type values in JSON logs, nested JAR URLs, unexpected outbound connections, new child processes, file modifications, and web shells
- Plan migration to Fastjson2 as the long-term fix; Fastjson2 is not vulnerable to this attack chain
- Implement network-level controls to restrict JSON parsing endpoints from untrusted sources where feasible; review authentication requirements for JSON API endpoints