CVE-2026-16723: Mitigating Fast 1.x Exploits Without a Patch?
Just saw the latest reports from ThreatBook and Imperva regarding CVE-2026-16723, and it looks like we have a situation on our hands. Attackers are actively exploiting a critical deserialization flaw in Fast 1.x, and unfortunately, there isn't a patch available yet.
With a CVSS score of 9.0, this is about as bad as it gets for Java environments. The confirmed attack chain allows for unauthenticated Remote Code Execution (RCE) on affected Spring Boot applications. If you're running this, the attacker effectively gets the privileges of the Java process.
Since we can't patch, mitigation is key. I've been hunting for signs of compromise in our logs. The payloads usually leverage the @type feature to trigger the deserialization gadget chain. Here is a basic KQL query I'm using to spot potential scanning activity:
// Hunt for Fast autotype usage in HTTP logs
HttpLogs
| where RequestMethod in ("POST", "PUT")
| where Body contains "@type"
| project Timestamp, SourceIP, Uri, Body
| take 100
The standard advice is to disable AutoType support immediately, but in legacy apps, that often breaks functionality.
Has anyone successfully rolled out a WAF rule to block this specific pattern without breaking their legitimate JSON traffic? Or are we looking at a forced migration to Jackson or Gson this weekend?
Forced migration is the only safe long-term play, but if you need a stopgap, you can try enforcing a 'safe mode' or a denylist for the autotype check. If you have access to the code, enforcing this check before parsing helps:
if (.contains("@type")) {
throw new SecurityException("Potential RCE payload detected");
}
It's crude, but it buys you time. We switched to Jackson last year; the migration effort was non-trivial, but it beats getting owned by a deserialization bug.
I'm seeing a lot of scanning traffic on port 8080 specifically trying to hit the /api/ endpoints with malformed JSON. If you can't patch the library, I recommend using a Runtime Application Self-Protection (RASP) agent. It intercepts the deserialization call at the JVM level and can kill the process before the payload executes.
If you are stuck with WAFs only, be careful. Attackers are obfuscating @type using unicode escapes, so simple string matching might fail.
We handled this by restricting the classpath. If the malicious gadget class isn't on the classpath, the RCE fails. Review your dependencies and remove commons-collections or obsolete Spring components if they aren't strictly needed.
Also, make sure your Fast version isn't so old that it ignores the AutoType disable flag. Versions pre-1.2.48 are notoriously stubborn.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access