Hackers are abusing a critical Fastjson zero‑day remote code execution (RCE) flaw to compromise U.S. organizations by simply sending malicious JSON data to vulnerable Java applications.
The attacks center on a vulnerability tracked as CVE‑2026‑16723 in Fastjson 1.x, an open‑source JSON parsing library widely used in Java and Spring Boot applications.
The flaw affects versions 1.2.68 through 1.2.83 and is exploitable under default configurations, meaning attackers do not need user interaction, elevated privileges, or special deserialization gadgets to gain code execution on target servers. Threat intelligence firm ThreatBook first observed the malicious activity, with Imperva later confirming broad exploitation against firms in financial services, healthcare, computing, retail, and other industries.
Technically, the issue lies in Fastjson’s type‑resolution logic, which performs attacker‑controlled resource lookups before enforcing AutoType restrictions. Security researchers from FearsOff showed that by abusing @type processing in Spring Boot “fat‑JAR” deployments, they could load and execute attacker‑supplied classes even when AutoType is disabled and without relying on traditional gadget chains. Alibaba’s advisory stresses that the vulnerability is exploitable on the most common Spring Boot executable JAR model launched via java -jar, and that specifying concrete classes for deserialization does not reliably mitigate the bug because payloads can hide inside generic Object or Map fields.
What makes this zero‑day particularly dangerous is the combination of wide adoption, ease of exploitation, and lack of a direct patch for Fastjson 1.x. Imperva notes that most observed attacks currently hit U.S. organizations, with early signs in Singapore and Canada, and expects the campaign to expand globally as exploit code circulates. Fastjson 1.x is no longer actively maintained, and Alibaba has explicitly signaled that this branch is unlikely to receive a security fix, leaving thousands of applications exposed unless they are re‑engineered.
Security vendors recommend that organizations immediately inventory applications using Fastjson 1.x and enable SafeMode via the appropriate JVM flag to hard‑block dangerous polymorphic deserialization paths. Longer term, developers are urged to either migrate to Fastjson2—which uses an allowlist‑first model and does not rely on the vulnerable @JSONType semantics—or replace Fastjson with other actively maintained JSON libraries. Until such changes are rolled out, defenders should deploy strict web application firewall rules to filter suspicious JSON payloads, monitor logs for exploitation attempts, and treat exposed services as high‑risk assets that may already be compromised.
