Hackers Actively Exploit FastJson RCE Vulnerability CVE-2026-16723
Summary
ThreatBook and Imperva report active exploitation of CVE-2026-16723 in FastJson 1.2.68–1.2.83. The flaw enables remote code execution in certain Spring Boot deployments; Alibaba has not issued a fix.
Key points
- ThreatBook observed exploitation last week; Imperva reported that attacks mainly target U.S. organizations, with some activity in Singapore and Canada.
- CVE-2026-16723 enables remote code execution without user interaction or elevated privileges in affected FastJson versions 1.2.68 through 1.2.83.
- Researchers say attacker-controlled resource lookups during type resolution can occur before AutoType restrictions, allowing malicious classes to be loaded and executed in Spring Boot executable fat-JAR deployments.
- Alibaba says the affected deployment prerequisite is running a Spring Boot executable fat-JAR; FastJson 2, FastJson 1.2.60 and earlier, and non-fat-JAR deployments are not affected.
- Alibaba has not issued a fix. Developers are advised to enable SafeMode or switch to a non-affected build; Imperva says FastJson 1.x is no longer actively maintained.
Article Details
- Vulnerability Types
- Remote code execution
- Attacker-controlled type resolution during deserialization
- Severity
- Critical
- Affected Versions
- FastJson 1.2.68 through 1.2.83
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Enable SafeMode.
- Switch to a non-affected build.
CVE
Vendors
Products
Countries
Canada“Attacks are currently almost entirely targeting US-based organizations, with a few attacks in Singapore and Canada, although this will likely continue to expand globally,” Imperva says.Singapore“Attacks are currently almost entirely targeting US-based organizations, with a few attacks in Singapore and Canada, although this will likely continue to expand globally,” Imperva says.United StatesThe attacks are primarily hitting U.S.-based organizations across multiple sectors, including financial services, healthcare, retail, and computing.
Industries
BusinessImperva reported victims across financial services, healthcare, computing, retail, and business sectors.ComputingThe attacks are primarily hitting U.S.-based organizations across multiple sectors, including financial services, healthcare, retail, and computing.Financial ServicesThe attacks are primarily hitting U.S.-based organizations across multiple sectors, including financial services, healthcare, retail, and computing.HealthcareThe attacks are primarily hitting U.S.-based organizations across multiple sectors, including financial services, healthcare, retail, and computing.RetailThe attacks are primarily hitting U.S.-based organizations across multiple sectors, including financial services, healthcare, retail, and computing.