CVE-2022-25845

CRITICAL

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain condition...

Affects 2 products across 2 vendors.

CVSS 3.19.8
EPSS18.7%
Percentile97th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-502: Deserialization of Untrusted Data

Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.

Related Attack Patterns (CAPEC)
CAPEC-586 Object Injection
via CWE-502

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The package com.alibaba:fastjson before version 1.2.83 is vulnerable to Deserialization of Untrusted Data, which can be exploited to attack remote servers by bypassing the default autoType shutdown restrictions.

BSID: BS-2022-GLOBAL-253447-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-25845?
The package com.alibaba:fastjson before version 1.2.83 is vulnerable to Deserialization of Untrusted Data, which can be exploited to attack remote servers by bypassing the default autoType shutdown restrictions.
What is the CVSS score for CVE-2022-25845?
CVE-2022-25845 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 18.7%.
Is CVE-2022-25845 actively exploited?
No confirmed active exploitation of CVE-2022-25845 as of 2026-09-25.
How do I remediate CVE-2022-25845?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-25845?
CVE-2022-25845 affects Alibaba Fastjson; Oracle Communications Cloud Native Core Unified Data Repository.
Vulnerability Details
CVE IDCVE-2022-25845
BSIDBS-2022-GLOBAL-253447-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2022-06-10
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Deserialization of Untrusted Data
SourceNVD
Official Description

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending specially crafted JSON data to a server that uses the vulnerable version of fastjson. This can lead to remote code execution, unauthorized access, or other malicious activities.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Alibaba Fastjson < 1.2.83
Oracle Communications Cloud Native Core Unified Data Repository 22.2.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1588 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashad3b4df700a7014c264574af228fc62284473cb45a9604f2fc07c2ff3e06b3ad7c3497a011f788a7602f5baa432f334ca089c2a768ab12defe4d61f36cf9b730
Related CVEs affecting Alibaba
CVE-2025-70974 10.0 Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a... CVE-2017-18349 9.8 parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.1... CVE-2021-29441 9.8 Nacos is a platform designed for dynamic service discovery and configuration ... CVE-2025-15573 9.4 The affected devices do not validate the server certificate when connecting t... CVE-2026-16723 9.0 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through...
View all Alibaba CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →