cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Unpatched Fastjson Vulnerability Exploited in Attacks

· Original article ↗

Summary

Researchers report attacks exploiting critical unauthenticated RCE CVE-2026-16723 in Fastjson 1.2.68–1.2.83. No official patch is available; recommended mitigations include migrating to Fastjson 2.x or enabling SafeMode.

Key points

  • CVE-2026-16723 is an unauthenticated remote code execution flaw rated CVSS 9.
  • The article says Fastjson 1.2.68 through 1.2.83 are affected; Fastjson 2.x is not.
  • Exploitation can work with the default configuration and does not require AutoType to be enabled or a classpath gadget, but the target must not have SafeMode enabled.
  • The described exploit uses crafted JSON with a malicious @type value; resource lookups and annotation-based trust behavior can bypass protections and lead to code execution.
  • Imperva reports observing attacks against organizations in multiple sectors in the US, as well as entities in Singapore and Canada.
  • No official patch is available. Recommended steps include migrating to Fastjson 2.x, enabling SafeMode, blocking certain POST and JSON requests, or using a build that removes vulnerable AutoType-related code.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution (RCE)
Severity
Critical (CVSS score 9)
Affected Versions
  • Fastjson 1.2.68–1.2.83
Exploitation Status
active
Exploit Availability
unknown
Patch Status
unavailable
Workarounds
  • Migrate to Fastjson 2.x.
  • Enable SafeMode.
  • Block POST and JSON requests containing specific strings.
  • Use a Fastjson build that removes the vulnerable AutoType-related code.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers are exploiting the Fastjson vulnerability against organizations' exposed applications to reach code execution on target servers.

CVE

CVE-2026-16723Tracked as CVE-2026-16723 (CVSS score of 9), the unauthenticated bug impacts all deployments running as a Spring Boot executable fat-jar, which is the most widely used deployment model.

Vendors

Alibaba GroupA popular JSON processing library for Java, Fastjson was developed by Alibaba for JSON serialization and deserialization.ImpervaThe attacker-controlled resource lookup and annotation-based trust behavior combine to circumvent the protections normally associated with disabling AutoType,” Imperva explains.ThreatBookintegrity, and availability of the system and potentially leading to full compromise of the server,” ThreatBook warned.

Products

FastJsonThreat actors have been exploiting a critical-severity remote code execution (RCE) vulnerability in Fastjson, security researchers warn.

Countries

CanadaSeveral attacks hit entities in Singapore and Canada.SingaporeSeveral attacks hit entities in Singapore and Canada.United StatesThe cybersecurity firm has observed attacks exploiting the CVE against organizations across the business, computing, financial services, healthcare, retail, and other sectors in the US.

Industries

ComputingThe cybersecurity firm has observed attacks exploiting the CVE against organizations across the business, computing, financial services, healthcare, retail, and other sectors in the US.Financial ServicesThe cybersecurity firm has observed attacks exploiting the CVE against organizations across the business, computing, financial services, healthcare, retail, and other sectors in the US.HealthcareThe cybersecurity firm has observed attacks exploiting the CVE against organizations across the business, computing, financial services, healthcare, retail, and other sectors in the US.RetailThe cybersecurity firm has observed attacks exploiting the CVE against organizations across the business, computing, financial services, healthcare, retail, and other sectors in the US.

Related Articles