FastJson Zero-Day RCE Exploited in Attacks Targeting US Firms
Hackers are actively exploiting a zero-day remote code execution vulnerability in the widely used FastJson Java library, with US organizations being the primary targets.
Cybercriminals are actively exploiting a critical zero-day vulnerability within the FastJson open-source Java library, enabling remote code execution (RCE) without requiring user interaction or elevated privileges. The security flaw, identified as CVE-2026-16723, affects FastJson versions 1.2.68 through 1.2.83 and has been observed in attacks targeting a broad spectrum of organizations across the United States.
Threat intelligence firm ThreatBook first observed the malicious activity last week, with researchers from Imperva confirming the widespread targeting. Imperva noted that while US-based organizations are the primary focus, attacks have also been seen in Singapore and Canada, with expectations of global expansion. The affected industries include Financial Services, Healthcare, Computing, Retail, and Business sectors, underscoring the pervasive risk posed by this vulnerability.
FastJson, an open-source Java library developed by Alibaba, is commonly used for serializing and deserializing Java objects to and from JSON. It boasts significant popularity, with over 25,000 stars and 6,400 forks on GitHub, and is particularly prevalent in Chinese enterprise software and projects built upon Alibaba's ecosystem. The vulnerability was initially detailed by offensive security company FearsOff, which published a technical analysis earlier this month.
The root cause of CVE-2026-16723 lies in FastJson's type-resolution logic. This logic performs attacker-controlled resource lookups before enforcing AutoType restrictions, creating a pathway for remote code execution, especially within Spring Boot fat-JAR deployments. By manipulating the @type processing, attackers can load and execute malicious classes even when AutoType is disabled or without relying on complex third-party gadget chains.
Alibaba has acknowledged the critical severity of the vulnerability in its security bulletin, emphasizing its exploitability in "the most common Spring Boot deployment model." The vendor specifically warned that the vulnerability is exploitable when applications are launched via java -jar xxx.jar. Furthermore, Alibaba stated that specifying a target class during deserialization does not mitigate the issue, as attackers can embed malicious payloads within common fields like ‘Object’ or ‘Map’.
Fortunately, the newer fastjson2 library is not affected, as it employs an allowlist-first model for polymorphic deserialization and does not depend on the @JSONType annotation as a trust indicator. Additionally, FastJson versions 1.2.60 and earlier, as well as non-fat-JAR deployments, are also considered safe from this specific exploit. Developers using affected versions are strongly advised to immediately enable SafeMode or migrate to a non-impacted build.
As of the latest reports, no patch has been issued for CVE-2026-16723. Compounding the issue, Imperva highlighted that FastJson 1.x is no longer actively maintained, making a security update for this version highly unlikely. This situation leaves organizations reliant on older FastJson versions with limited options beyond implementing workarounds or migrating to the newer fastjson2 library or alternative solutions.
The active exploitation of this zero-day vulnerability serves as a stark reminder of the risks associated with open-source software dependencies. Organizations must maintain robust vulnerability management programs, including continuous monitoring of software components and prompt application of security patches or mitigations when available. The lack of an immediate fix for CVE-2026-16723 underscores the importance of proactive security measures and rapid response planning for zero-day threats.