Reported by 2 outlets

Timeline

1. original reporting

   FastJson CVE-2026-16723: Critical RCE Actively Exploited — No Patch Available

   thehackernews.com · 80d ago · July 26th, 2026

   A critical remote code execution vulnerability in Alibaba Fastjson (the widely used Java JSON library) tracked as CVE-2026-16723 (CVSS 9.0) is under active exploitation with no patched Fastjson 1.x release available. Security firms Imperva and ThreatBook report active attacks targeting financial services, healthcare, computing, and retail organizations primarily in the United States, Singapore, and Canada.

   Key details:

   • Affects Fastjson 1.2.68 through 1.2.83 (version 1.2.83 is the latest 1.x release and remains vulnerable)

   • Works under stock default configuration — AutoType does not need to be enabled, and no classpath gadget is required

   • Exploitable in Spring Boot fat-JAR deployments via crafted JSON @type values

   • Alibaba published a security advisory on July 21 but has not released a patched 1.x artifact

   • Full technical details and working proof-of-concept exploit code are now public

   • Qi'anxin estimates millions of exposed instances

   This flaw is particularly dangerous because it bypasses protections that defenders relied on after earlier Fastjson disclosures (AutoType disablement, gadget-free classpath). Organizations running Fastjson 1.x behind internet-facing Spring Boot services have no straightforward patch to apply.

   Mitigation (no patch available): Enable SafeMode in Fastjson configuration. Review whether Fastjson 1.x can be replaced with a maintained fork or newer library version. Segment internet-facing Spring Boot services. Monitor for deserialization attack patterns in JSON payloads. Consider WAF rules to block anomalous @type values in JSON bodies where feasible.

   Action: Immediately audit all Java services for Fastjson 1.x dependency. Prioritize services that are internet-facing or process untrusted JSON. If migration is not immediately feasible, implement compensating controls (WAF, network segmentation, input validation).

   ---

2. update from bleepingcomputer.com

   FastJson CVE-2026-16723: Active RCE Exploitation Continues — No Patch Available

   bleepingcomputer.com · 78d ago · July 28th, 2026

   Previously identified as a gap on Jul 26. New today: BleepingComputer and SecurityWeek carry confirmed targeting details from Imperva and ThreatBook.

   Hackers are actively exploiting CVE-2026-16723 (CVSS 9.0), an unauthenticated remote code execution vulnerability in Alibaba's FastJson Java library affecting versions 1.2.68 through 1.2.83. New details confirmed by Imperva and ThreatBook:

   • Attacks target Financial Services, Healthcare, Computing, Retail, and Business sectors

   • Focused primarily on US-based organizations, with some attacks in Singapore and Canada

   • Roughly 30% of observed attacks originate from Ruby and Go tools; the rest from browser impersonators

   • Exploitation achieved via crafted JSON @type values to trigger resource lookups that bypass AutoType restrictions

   • No patched FastJson 1.x release exists — Alibaba published an advisory on July 21 but has not shipped a fix for the 1.x branch

   • Only mitigation: migrate to FastJson 2.x or enable SafeMode

   Organizations running FastJson 1.x behind internet-facing Spring Boot services have no straightforward patch to apply. Any exposed service processing untrusted JSON should be treated as high-priority remediation.