A newly discovered vulnerability in the FastJson library, designated as CVE-2026-16723, is actively being exploited against various organizations in the United States. This threat affects Java applications that handle untrusted JSON data, posing a significant risk to those using the vulnerable software.
Understanding the FastJson RCE Vulnerability
The vulnerability has been assigned a high CVSS severity score of 9.0, impacting FastJson versions 1.2.68 through 1.2.83. FastJson, developed by Alibaba, facilitates the conversion of Java objects to JSON and vice versa. The flaw was made public on July 21, 2026, after thorough research by FearsOff Cybersecurity and affects certain Spring Boot applications.
This security issue is severe because it allows attackers to exploit systems without needing valid credentials or user interaction. By manipulating the way FastJson processes JSON data, specifically the @type field, attackers can force the application to execute arbitrary Java classes during deserialization.
Exploitation Techniques and Impact
Exploiting this vulnerability involves sending crafted JSON to a vulnerable server, which can be processed using standard FastJson methods. Despite the library’s attempt to mitigate risks by disabling AutoType, attackers have found ways to bypass this, leading to potential code execution.
In Spring Boot fat-JAR deployments, attackers can manipulate class names in JSON data to trigger resource lookups, bypassing traditional security measures. This can result in unauthorized command execution, malware deployment, and even full control of the affected server.
Protective Measures and Recommendations
Currently, FastJson 2.x is not susceptible to this vulnerability due to its improved architecture. Organizations are advised to enable FastJson SafeMode immediately using the command -DFastJson.parser.safeMode=true or through ParserConfig settings.
Security teams should assess their systems for both direct and indirect FastJson dependencies and examine logs for unusual activity. Since FastJson 1.x is no longer maintained, migrating to FastJson 2.x is strongly recommended after compatibility checks.
Additionally, organizations should strengthen their security operations centers (SOCs) by enhancing threat detection capabilities and conducting rapid investigations to mitigate potential damages from such vulnerabilities.
As attackers continue to target diverse sectors such as finance, healthcare, retail, and computing, staying informed and proactive in securing vulnerable systems is critical to thwarting these sophisticated cyber threats.
