Hackers Exploit Critical FastJson 1.x Zero-Day to Execute Code on US Servers
CVE-2026-16723 bypasses default security in Spring Boot fat JAR deployments. No patch exists for the unmaintained 1.x branch.
Active Exploitation Underway
Attackers are actively exploiting a critical remote code execution vulnerability in FastJson, a widely-used Java JSON library developed by Alibaba. The flaw, tracked as CVE-2026-16723, carries a CVSS score of 9.0 and allows unauthenticated attackers to execute arbitrary code on vulnerable servers.
The vulnerability was disclosed on July 21, 2026, by Kirill Firsov of FearsOff Cybersecurity. Active attacks are currently targeting US-based organizations primarily, with additional incidents reported in Singapore and Canada. Affected sectors include financial services, healthcare, computing, and retail.
What Makes This Vulnerability Dangerous
The issue is particularly dangerous because it is exploitable under FastJson's default configuration. AutoType does not need to be enabled, and attackers do not need a suitable third-party gadget class to be present in the application's classpath, according to Imperva Threat Research.
The vulnerability affects FastJson versions 1.2.68 through 1.2.83. Versions 1.2.67 and earlier are not affected by this specific flaw. The exploitation chain works by abusing the @JSONType annotation as a trust signal, combined with nested JAR URL lookups that are possible in Spring Boot fat-JAR deployments.
Verified exploitation has been observed across Spring Boot 2.x, 3.x, and 4.x running on JDK versions 8, 11, 17, and 21.
No Patch Available for 1.x Branch
FastJson 1.x is no longer actively maintained, and Alibaba has not released a patched version for this vulnerability. The final 1.x release, version 1.2.83, remains vulnerable.
Organizations have two mitigation options: enable SafeMode by setting the JVM flag -DFastJson.parser.safeMode=true, or migrate to FastJson 2.x, which is not affected by this vulnerability.
Attack Traffic Patterns
According to Imperva's telemetry, most attacks are coming from browser impersonators, with tools written in Ruby and Go accounting for about 30% of all attacks collectively. This breakdown relies solely on Imperva's data and has not been independently corroborated.
The vulnerability highlights the ongoing risk posed by unmaintained open-source dependencies in enterprise Java applications. With no patch forthcoming for the 1.x branch, organizations running affected versions must prioritize migration or implement SafeMode immediately.