🛡️ **FastJson RCE Zero-Day Actively Exploited Against US Organizations**
Published Monday, July 27, 2026 at 10:16 PM PT BLUF: Attackers are actively exploiting CVE-2026-16723, a critical remote code execution vulnerability in FastJson library versions 1.2.68–1.2.83, targeting US-based organizations across financial services, healthcare, computing, and retail sectors. Immediate action required: downgrade to version 1.2.60 or earlier, migrate to fastjson2, enable SafeMode, or redesign Spring Boot deployments to eliminate fat-JAR execution. DETAILS: • CVE-2026-16723 permits unauthenticated remote code execution via malicious @type processing during deserialization of Java objects. Exploitation requires no user interaction or elevated privileges and bypasses AutoType restrictions by abusing type-resolution logic that performs attacker-controlled resource lookups before enforcing safeguards. • Vulnerability is limited to Spring Boot fat-JAR deployments (executed via java -jar xxx.jar); FastJson versions 1.2.60 and earlier, fastjson2, and non-fat-JAR deployments are unaffected. • Active exploitation confirmed since last week by threat research firms ThreatBook and Imperva, targeting organizations across Financial Services, Healthcare, Computing, Retail, and Business Services. Geographic scope currently concentrated in US with secondary activity in Singapore and Canada. • No vendor patch available. FastJson 1.x is no longer actively maintained by Alibaba (the library’s developer), making security updates unlikely. • Specifying target classes or using non-fat-JAR deployment models do not mitigate the vulnerability; attackers can embed payloads in Object or Map fields. ...