Unpatched Fastjson Vulnerability Exploited in Attacks
A critical remote code execution (RCE) vulnerability in Fastjson, a popular Java JSON processing library, has been actively exploited by threat actors. The vulnerability, tracked as CVE-2026-16723, allows attackers to execute arbitrary code without authentication, impacting deployments running as Spring Boot executable fat-jars. Organizations across various sectors, including those in the US, Singapore, and Canada, have been targeted.
A critical remote code execution (RCE) vulnerability in Fastjson, a widely used Java JSON processing library developed by Alibaba, is currently being exploited by threat actors. Tracked as CVE-2026-16723, this vulnerability has a CVSS score of 9 and affects all Fastjson versions 1.2.68 through 1.2.83, which are no longer supported. The issue stems from a bypass that can be triggered by crafted JSON files containing a malicious `@type` value, allowing attackers to manipulate the library and execute code without requiring authentication or user interaction.
“This vulnerability is exploitable under Fastjson’s stock default configuration — no AutoType enablement required, no classpath gadget required,” Alibaba notes in its advisory. The flaw can be exploited via crafted JSON files containing a malicious `@type` value to manipulate the library into performing resource lookups, bypassing restrictions and reaching a path for code execution.
“Because exploitation requires no authentication, no user interaction, and no external gadget library, exposed applications running affected configurations should be treated as high-priority remediation targets,” Imperva notes. The cybersecurity firm has observed attacks exploiting the CVE against organizations across the business, computing, financial services, healthcare, and retail sectors in the US, with several attacks targeting entities in Singapore and Canada.
Most of the observed attacks have originated from browser impersonators, with roughly 30% originating from tools written in Ruby and Go. Organizations are advised to migrate to Fastjson 2.x, or, if migration is not possible, to enable SafeMode, block POST and JSON requests that contain specific strings, or use a Fastjson build that removes the vulnerable AutoType-related code.
Related: Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day
Related: New GitHub, PyPI Policies Boost Supply Chain Security
Related: Rockwell Patches Code Execution Flaws in Arena Simulation Software
Related: OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider