Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Summary: Security firms ThreatBook and Imperva say attackers are targeting CVE-2026-16723, a Fastjson 1.x flaw with an Alibaba-assigned CVSS score of 9.0 that lets a malicious JSON request execute code without authentication in affected Spring Boot fat-JAR applications. The confirmed chain requires Fastjson 1.2.68 through 1.2.83, a network-reachable parser path, and SafeMode left disabled, and as of July 25 Alibaba had released no fixed Fastjson 1.x version.
What you should know: The exploit needs no AutoType enablement and no classpath gadget, so the SafeMode-off default that many teams never changed is the whole exposure - and the only interim options are enabling SafeMode or moving to the restricted 1.2.83_noneautotype build while Fastjson2 migration waits.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-16723
Related: Attackers Exploit Arista Velo Cloud Orchestrator Command Injection Flaw Cyber Risks ·
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, Click Fix Lures and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026