Hackers exploit FastJson zero-day against US firms

Hackers are actively exploiting a critical vulnerability in Alibaba’s FastJson Java library, enabling remote code execution without user interaction or elevated privileges. The attacks are focused mainly on organizations in the United States, with limited activity reported in Singapore and Canada.

The vulnerability, tracked as CVE-2026-16723, affects FastJson versions 1.2.68 through 1.2.83. ThreatBook observed the malicious activity last week, while Imperva confirmed attacks against organizations in financial services, healthcare, computing, retail, business, and other industries.

“Attacks are currently almost entirely targeting US-based organizations, with a few attacks in Singapore and Canada, although this will likely continue to expand globally.”

FastJson is used to serialize Java objects to JSON and back. The open-source project has 25,600 GitHub stars and 6,400 forks, and is particularly common in Chinese enterprise software and projects built on Alibaba’s platform.

How CVE-2026-16723 enables remote code execution

Offensive security company FearsOff discovered the flaw and published a technical analysis earlier this month. The issue lies in FastJson’s type-resolution logic, which performs attacker-controlled resource lookups before enforcing AutoType restrictions.

By abusing @type processing, attackers can load and execute malicious classes in Spring Boot executable fat-JAR deployments, without AutoType enabled and without third-party gadget chains. Alibaba says the vulnerability is exploitable in the most common Spring Boot deployment model:

Recommended reading

iOS 26.6 closes 78 vulnerabilities

“The only deployment prerequisite is that the target runs as a Spring Boot executable fat-jar (i.e., launched via java -jar xxx.jar).”

Specifying a target class during deserialization does not prevent exploitation, because malicious payloads can be embedded in Object or Map fields. The vulnerable logic is absent from fastjson2, which uses an allowlist-first model and does not treat the @JSONType annotation as a trust signal.

No patch is available

FastJson versions 1.2.60 and earlier are not affected, nor are deployments that do not use fat JARs. Developers running an affected version should immediately enable SafeMode or migrate to a non-impacted build.

Alibaba has not issued a fix for CVE-2026-16723. Imperva also says FastJson 1.x is no longer actively maintained, making a future security update unlikely.

×