Hackers exploit FastJson vulnerability for remote code execution

Bleeping Computer disclosed that hackers are actively exploiting a critical vulnerability in the FastJson open-source Java library, enabling remote code execution without requiring user interaction or elevated privileges.

The security flaw, identified as CVE-2026-16723, affects FastJson versions 1.2.68 through 1.2.83. ThreatBook researchers observed the malicious activity last week, with Imperva confirming that a wide range of organizations across Financial Services, Healthcare, Computing, Retail, and Business industries are being targeted. Attacks are primarily focused on U.S. organizations, with some instances in Singapore and Canada. The vulnerability stems from the library's type-resolution logic, which allows attackers to execute malicious code remotely, particularly in Spring Boot fat-JAR deployments. Alibaba confirmed the critical severity and noted that the issue is exploitable on the most common Spring Boot deployment model. A fix is not available, and FastJson 1.x is no longer actively maintained, making it unlikely to receive an update. Developers are advised to enable SafeMode or switch to a non-impacted build, such as fastjson2, which uses a more secure allowlist-first model.

Source: Bleeping Computer