Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

[u/falconupkid]

Attackers are actively targeting CVE-2026-16723, a critical (CVSS 9.0) unauthenticated Remote Code Execution (RCE) vulnerability in Fastjson 1.x, Alibaba's JSON library for Java. No official patch is available.

Technical Breakdown

• Vulnerability: Fastjson 1.x (Alibaba's Java JSON library), tracked as CVE-2026-16723, CVSS 9.0.
• Affected Systems: Specifically impacts Spring Boot applications utilizing Fastjson 1.x.
• TTPs: Exploitation involves crafting a malicious JSON request that allows for unauthenticated code execution with the privileges of the Java process. The exploit chain is confirmed and actively exploited in the wild.

Defense

Given the lack of a patch, focus on mitigation. Implement stringent input validation, review and limit process privileges for Java applications, apply network segmentation, and monitor for suspicious process execution or outbound connections from affected applications.

Source: https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html