Security experts have identified an ongoing exploitation of a high-risk remote code execution (RCE) vulnerability in the Fastjson library used for Java. This vulnerability, which poses a significant threat, is being actively targeted by cyber attackers.
Understanding the Fastjson Vulnerability
Fastjson, a widely utilized JSON processing library created by Alibaba for JSON serialization and deserialization, is at the center of this threat. The flaw, tracked as CVE-2026-16723 with a critical CVSS score of 9, affects all deployments that operate as a Spring Boot executable fat-jar — the predominant deployment model.
According to Alibaba’s advisory, this vulnerability can be exploited without enabling AutoType or requiring any classpath gadget, making it particularly concerning. The issue is present in Fastjson versions 1.2.68 through 1.2.83, the last of the 1.x series, which are no longer maintained. Notably, the newer 2.x versions remain unaffected.
Potential Impact and Exploitation Techniques
Threat actors who successfully exploit this vulnerability can execute arbitrary code on vulnerable servers that have not enabled SafeMode. This poses a direct threat to the system’s confidentiality, integrity, and availability, potentially resulting in a complete server compromise, as highlighted by ThreatBook.
The attack vector involves specially crafted JSON files that contain a malicious @type value. This approach manipulates the library into performing unauthorized resource lookups, bypassing standard restrictions, and reaching paths that allow for code execution. Imperva explains that this is possible because Fastjson 1.x interprets the presence of a @JSONType annotation as a trust signal during type resolution.
Global Impact and Mitigation Measures
Imperva has observed that this vulnerability is being actively exploited across various sectors, including business, computing, financial services, healthcare, and retail, with attacks reported in the US, Singapore, and Canada. Many of these attacks are initiated by browser impersonators, and about 30% are executed using tools developed in Ruby and Go.
As no official patch has been released for this vulnerability, organizations are urged to upgrade to Fastjson 2.x. If upgrading is not feasible, enabling SafeMode, blocking POST and JSON requests with specific strings, or using a Fastjson build that removes the vulnerable code is recommended.
Imperva stresses the urgency of addressing this issue, as exploitation requires no authentication, user interaction, or external gadget library. Applications with vulnerable configurations should be prioritized for remediation to prevent potential breaches.
