Hackers are actively exploiting a critical vulnerability in the FastJson open-source Java library that allows remote code execution without requiring user interaction or elevated privileges.
The flaw, tracked as CVE-2026-16723, affects FastJson versions 1.2.68 through 1.2.83 and is already being used in attacks against organizations across the United States.
The attacks were first detected last week by security company ThreatBook, while researchers at Imperva confirmed the ongoing campaign. According to Imperva, the attacks are targeting businesses in several industries, including financial services, healthcare, retail, computing, and other sectors. Most of the activity is currently focused on U.S.-based organizations, although some attacks have also been observed in Singapore and Canada, suggesting the campaign could spread further.
FastJson is an open-source Java library developed by Alibaba that converts Java objects to and from JSON. It is widely used in enterprise applications, particularly those built on Alibaba’s ecosystem, making the vulnerability a significant concern for developers and organizations.
The security flaw was discovered by offensive security company FearsOff, which published technical details earlier this month. Researchers found that the vulnerability exists because FastJson performs attacker-controlled resource lookups before enforcing its AutoType security restrictions. This behavior creates a path for remote code execution in applications deployed as Spring Boot executable fat-JAR files.
By abusing FastJson’s @type processing, attackers can load and execute malicious classes even when AutoType is disabled and without relying on third-party gadget chains, making the exploit more dangerous than previous FastJson vulnerabilities.
Alibaba has confirmed the vulnerability and warned that it affects the most common Spring Boot deployment model where applications are launched using the “java -jar” command. The company also noted that specifying a target class during deserialization does not protect against the flaw because attackers can hide malicious payloads inside Object or Map fields.
The issue does not affect FastJson2, which uses a more secure allowlist-based deserialization model. Likewise, FastJson versions 1.2.60 and earlier, as well as deployments that do not use Spring Boot fat-JARs, are not vulnerable.
There is currently no security patch available for CVE-2026-16723. Alibaba recommends that developers using affected versions immediately enable SafeMode or migrate to a non-vulnerable version. Imperva also warned that FastJson 1.x is no longer actively maintained, making it unlikely that a future security update will be released.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
