Hackers are actively exploiting vulnerabilities within the FastJson open supply Java library to allow distant code execution with out person interplay or privilege escalation.
This safety situation impacts FastJson variations 1.2.68 to 1.2.83 and has been exploited in assaults concentrating on numerous organizations in america.
The malicious exercise was noticed final week by agent safety agency ThreatBook, and researchers at enterprise safety agency Imperva confirmed that the exercise was “concentrating on a variety of organizations throughout monetary providers, healthcare, computing, retail, enterprise, and different industries.”
“At the moment, assaults are virtually completely concentrating on organizations based mostly in america, with a small variety of assaults in Singapore and Canada, however it’s more likely to proceed to increase globally,” Imperva stated.
Supply: Imperva
FastJson is an open supply Java library developed by Alibaba that’s used to serialize Java objects to JSON and vice versa.
The challenge has 25,600 stars and 6,400 forks on GitHub and is especially common amongst Chinese language enterprise software program and tasks constructed on Alibaba’s platform.
CVE-2026-16723 was found by aggressive safety agency FearsOff, which printed a technical doc earlier this month.
The researchers defined that the flaw stems from the library’s sort decision logic, which performs an attacker-controlled useful resource lookup earlier than imposing AutoType restrictions. This creates a path for operating your code remotely in a Spring Boot fat-JAR deployment.
By exploiting @sort dealing with, researchers had been in a position to load and execute malicious lessons with out enabling AutoType or requiring a third-party gadget chain.
No fixes out there
In a safety bulletin, Alibaba confirmed the severity of the vulnerability as important and warned that it may very well be exploited in “the commonest Spring Boot deployment fashions.”
“The one deployment prerequisite is that the goal runs as a Spring Boot executable fat-jar (i.e., launched through java -jar xxx.jar),” Alibaba’s safety advisory states.
The seller states that specifying the goal class throughout deserialization doesn’t mitigate CVE-2026-16723 as a result of an attacker may embed a malicious payload throughout the “object” or “map” fields.
Fragile sort decision logic doesn’t exist in fastjson2. fastjson2 makes use of a whitelist-first mannequin for polymorphic deserialization and doesn’t depend on the @JSONType annotation as a belief sign.
Additionally, FastJson variations 1.2.60 and earlier and non-Fats-JAR deployments are usually not affected.
Builders utilizing variations throughout the affected vary are inspired to instantly allow protected mode or change to an unaffected construct.
No repair is at present printed for CVE-2026-16723. Imperva additionally notes that FastJson 1.x will not be at present actively maintained and is unlikely to obtain safety updates.
Safety groups doc 54% of profitable assaults and situation a warning on solely 14%. The remainder strikes invisibly by means of the atmosphere.
Picus’ whitepaper reveals the right way to take a look at your SIEM and EDR guidelines in breach and assault simulations to make sure threats go undetected.
Get the white paper
