Critical Apache Shiro RCE Vulnerability Under Active Exploitation

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-16723, has been discovered in FastJson versions 1.2.68 through 1.2.83.
• This flaw carries a CVSS score of 9.0 and is under active exploitation against Java applications, particularly those in the U.S.
• Attackers can exploit the vulnerability without credentials, user interaction, or AutoType enabled.
• FastJson 1.x is no longer maintained; migration to FastJson 2.x is recommended, along with immediate SafeMode activation.

A severe vulnerability within the FastJson library, tracked as CVE-2026-16723, is currently being leveraged by threat actors. This critical flaw, affecting Java applications that process untrusted JSON data, poses an immediate risk to organizations, with significant exploitation observed within the United States.

The vulnerability, which impacts FastJson versions from 1.2.68 up to the final 1.x release, 1.2.83, has been assigned a CVSS severity score of 9.0. FastJson, an open-source Java library developed by Alibaba, is widely used for converting Java objects to JSON and vice versa.

FearsOff Cybersecurity’s research led to the disclosure of this issue by FastJson maintainers on July 21, 2026. It has been specifically confirmed to affect Spring Boot applications packaged as executable fat JAR files, including deployments running Spring Boot versions 2.x, 3.x, and 4.x on JDK 8, 11, 17, and 21.

FastJson RCE 0-Day Vulnerability

Exploitation Mechanics

The severity of this vulnerability stems from the ease of its exploitation. Attackers do not require valid credentials, user interaction, the AutoType feature to be enabled, or any third-party deserialization gadgets within the target application’s classpath. A vulnerable server can be compromised simply by processing malicious JSON data through standard methods such as JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class).

The exploit leverages FastJson’s handling of the “@type” JSON field, which typically instructs the library to instantiate a specific Java class during deserialization. Although FastJson 1.x attempts to mitigate dangerous class loading by disabling AutoType by default, researchers have identified a bypass within the library’s internal type-resolution mechanism.

In affected Spring Boot fat-JAR deployments, specially crafted JSON can trigger resource lookups based on an attacker-controlled class name. Threat actors can then utilize nested JAR URL handling to circumvent standard type restrictions and achieve a remote code execution path. Furthermore, FastJson 1.x incorrectly interprets the presence of the “@JSONType” annotation as a signal of trust, enabling malicious input to bypass existing protections. Successful exploitation grants a remote attacker the ability to execute arbitrary commands with the same privileges as the compromised Java application.

Impact and Observed Exploitation

The consequences of successful exploitation are severe, potentially leading to the deployment of web shells or malware, data exfiltration, credential harvesting, establishment of persistence, lateral movement within the network, or complete control over the underlying server. Exploitation attempts have been observed across a diverse range of industries, including financial services, healthcare, retail, computing, and business services.

Imperva reports that while the majority of attacks have targeted organizations in the United States, smaller campaigns have also been detected in Singapore and Canada. Broader exploitation is anticipated as public proof-of-concept details become more widely available.

Many observed requests mimic legitimate browser user-agent strings to evade detection. However, approximately 30% of the exploit traffic originates from tools developed in Ruby and Go, suggesting the use of automated scanning and exploitation frameworks.

It is important to note that FastJson 2.x is not affected by CVE-2026-16723. This is due to its redesigned architecture, which does not perform similar resource probing on attacker-controlled type names and implements an allowlist-first approach for polymorphic deserialization.

What You Should Do

• Immediately enable FastJson SafeMode using the command -DFastJson.parser.safeMode=true or by programmatically setting ParserConfig.getGlobalInstance().setSafeMode(true).
• Identify all direct and transitive FastJson dependencies within your applications.
• Scrutinize logs for suspicious values related to @type, jar:http, and jar:file.
• Investigate any unexpected commands, outbound network connections, unauthorized file modifications, or the presence of web shells.
• Given that FastJson 1.x is no longer maintained and no patch is available for this vulnerability, prioritize migrating to FastJson 2.x after thorough compatibility testing.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.