CVE-2026-16723: The Fastjson Zero-Day Your Pen Test Probably Missed

CVE-2026-16723. CVSS 9.0. Actively exploited. No patch.

Fastjson is a JSON parsing library built by Alibaba and embedded in thousands of Java applications worldwide. On July 21, 2026, Alibaba published an advisory for a critical flaw discovered by Kirill Firsov of FearsOff Cybersecurity: a malicious JSON request sent to any endpoint calling JSON.parse or JSON.parseObject executes arbitrary code on the server. No authentication. No special configuration. The vulnerable setup is the default.

ThreatBook had exploitation in the wild confirmed by July 22. Imperva published attack data on July 25 showing activity against financial services, healthcare, and retail organizations in the United States. Alibaba has not released a patched Fastjson 1.x version. The only available mitigations are a JVM flag and an alternative artifact - neither of which will be deployed across most affected environments before attackers find them first.

This bothers me for a specific reason. The vulnerability is in a library. The exploit goes through the application's own legitimate endpoints. A vulnerability scanner looking for CVEs would not have caught this before July 21, and given scanner update cycles, probably would not have caught it at peak exploitation window either. But a penetration test - a real one, with proper scope - could have flagged the exposure before the CVE existed.

How the Exploit Works

Firsov traced the vulnerability to Fastjson's type-resolution path. An attacker-controlled @type value in a JSON payload can be turned into a class-resource lookup. In a Spring Boot executable fat-JAR - which bundles the application and its dependencies into a single runnable JAR file - a crafted nested JAR path can fetch attacker-controlled bytecode. An @JSONType annotation in that resource passes Fastjson's type checks and loads the class.

The result: code runs on the server with the privileges of the Java process. No AutoType enablement required. No classpath gadget needed. The attack chain works through the parsing of a single JSON request containing the crafted payload.

Entry points include JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Binding input to a fixed class is not sufficient protection when the object contains an Object or Map field where the payload can be nested inside legitimate structure. In practice, this means most endpoints that accept JSON objects with mixed-type fields are reachable.

Alibaba verified the chain on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21. Plain non-fat JARs and WAR deployments are listed as unaffected. But Spring Boot fat-JARs are the standard deployment pattern for Java microservices in cloud environments. The organizations Imperva observed being targeted - financial services, healthcare, retail - are running exactly this pattern.

Why Your Last Pen Test Did Not Find This

Most penetration testing engagements are scoped around the application surface. Authentication, authorization, session management, input validation, business logic, OWASP Top 10. The pen tester gets access to the application, runs a scanner, tests the common attack paths, and produces a report with findings ranked by CVSS score.

The third-party library section of that report typically shows whatever the scanner found against known CVEs. If there are no known CVEs for the libraries in use, the section shows clean. The pen test completed. The application passed. The library is running a vulnerable version of Fastjson.

The problem is in the scope, not the tester. Most pen test scopes do not include: enumerate all third-party libraries in the application stack, map exact versions in use, research each library for known or theoretical exploitable conditions, and test whether those conditions can be reached through the application's own endpoints. That work requires time, access to source dependencies or compiled artifacts, and a testing approach that treats the library layer as part of the attack surface rather than as the application vendor's problem.

Fastjson 1.2.83 - the most recently affected version - was released years before this CVE. Every organization using it had a production library with a latent critical vulnerability, and no standard pen test process would have surfaced it before Firsov's research and Alibaba's disclosure.

The Difference Between a Scanner and a Pen Test

A vulnerability scanner does one thing: it compares what it finds against a database of known vulnerabilities. It is fast, repeatable, and very good at finding what it knows about. It cannot find what is not in its database. And for a zero-day with active exploitation before the CVE existed - like what happened with Fastjson this week - the scanner's database is the wrong tool.

A penetration test does something different. It finds what is actually exploitable in your specific environment. The scope question is: does that mean testing the application endpoints, or does it include testing the library stack those endpoints rely on? For most organizations, the honest answer is that the scope stops at the application layer.

The Fastjson exploit demonstrates what happens when scope stops too early. The vulnerable code is three layers deep from the visible application surface. The exploit uses the application's own endpoints as a vector. The vulnerable configuration is the default. None of that is visible without looking specifically at the library layer.

Expanding pen test scope to include library-level testing adds cost and time. But the comparison is not between the cost of expanded testing and the cost of nothing. It is between the cost of expanded testing and the cost of a CVSS 9.0 RCE being exploited in production before you know it exists.

What to Do Right Now

Apply the interim mitigation immediately if you are running Fastjson 1.x. Add the JVM flag -Dfastjson.parser.safeMode=true or switch to com.alibaba:fastjson:1.2.83_noneautotype. These are the only available mitigations while a patched Fastjson 1.x version is unavailable. Migrating to Fastjson2 is the right long-term fix and eliminates the vulnerable code path entirely.

Inventory your Fastjson deployments across the application estate. Fastjson is often embedded as an indirect dependency, pulled in by frameworks and other libraries rather than declared directly. Check your bill of materials, not just direct dependencies. Applications that do not explicitly reference Fastjson may still be running it.

Check endpoint exposure specifically. The mitigation protects the parser. But the right question is also: which application endpoints call JSON.parse or JSON.parseObject with input that includes Object or Map fields where attacker-controlled content could be nested? Identify these endpoints, apply the mitigation, and monitor them specifically for unusual JSON structure in request payloads.

Revisit your pen test scope for the next cycle. The immediate mitigation for Fastjson is not a pen test question. But the process failure that let a CVSS 9.0 library vulnerability sit in production undetected is. Add explicit scope for third-party library enumeration and version mapping to your next engagement. Require the pen tester to document every identified library version and explicitly assess known and theoretical exploitation paths for each one in scope.

Add library monitoring to your vulnerability management program. CVE scanners catch known CVEs after they are in the database. For critical application libraries like Fastjson, subscribe to the library's release feed and security advisory channel directly. Treat a new major version release as a trigger to review the changelog for security-relevant changes, not just wait for scanner coverage to catch up.