Critical Fastjson vulnerability allows remote code execution as hackers exploit 0-Day to attack US organizations
FearsOff CybersecurityFastJson

Critical Fastjson vulnerability allows remote code execution as hackers exploit 0-Day to attack US organizations

A critical vulnerability in FastJson, identified as CVE-2026-16723, is being exploited against U.S. organizations, allowing remote code execution without valid credentials. The flaw affects versions 1.2.68 to 1.2.83, with a CVSS score of 9.0, prompting urgent migration to FastJson 2.x for affected users.

CyberSecurityNews CyberSecurityNews29 July 2026 · 00:31 UTC
CuriousCats Full Story

A critical vulnerability in FastJson, known as CVE-2026-16723, is currently being exploited against U.S. organizations, posing a significant risk to Java applications.

Disclosed on July 21, 2026, by FastJson maintainers after research from FearsOff Cybersecurity, this flaw has a CVSS severity score of 9.0 and affects FastJson versions 1.2.68 to 1.2.83, the last release line of FastJson 1.x.3

The vulnerability is particularly severe as attackers do not need valid credentials, user interaction, AutoType enabled, or any in the target application’s classpath to exploit it.

Exploitation attempts have been observed across various sectors, including financial services, healthcare, retail, computing, and business services. While most attacks are targeting U.S. organizations, smaller campaigns have also been noted in Singapore and Canada, with broader exploitation anticipated as public proof-of-concept details become widely available.

Organizations are urged to immediately enable FastJson SafeMode using the command -DFastJson.parser.safeMode=true or by setting ParserConfig.getGlobalInstance().setSafeMode(true). Since FastJson 1.x is no longer actively maintained and no patch is available, affected organizations should prioritize migrating to FastJson 2.x after conducting compatibility testing.2

Key Insight
“The issue was disclosed on July 21, 2026, by FastJson maintainers following research from FearsOff Cybersecurity. Organizations are urged to enable FastJson SafeMode immediately or migrate to FastJson 2.x, as no patch is available for the outdated 1.x version.”
CuriousCats studied:
1
CyberSecurityNewsCyberSecurityNews
“A critical vulnerability in FastJson, identified as CVE-2026-16723, is being exploited against organizations in the United States, putting Java applications that at immediate risk.”
CyberSecurityNews →
Ask CuriousCats
What is the Fastjson vulnerability?
Why is it critical for cybersecurity?
How should organizations respond to this vulnerability?
Are there any patches for Fastjson 1.x?
How does Fastjson 2.x improve security standards?
CuriousCats STORYARC
EARLIER IN THE STORY:
Hackers are actively exploiting FastJson RCE vulnerability, targeting US firms with zero-day attacks.
BleepingComputer
Hackers are actively exploiting FastJson RCE vulnerability, targeting US firms with zero-day attacks.

Hackers are exploiting a vulnerability in the FastJson library, enabling remote code execution.

Alibaba GroupFastjson VulnerabilityImperva
2026-07-28
TL;DR by CuriousCats.ai
  • Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.
  • The security issue affects FastJson versions 1.2.68 through 1.2.83 and is leveraged in attacks targeting various organizations in the U.S.
  • Attacks are currently almost entirely targeting US-based organizations, with a few attacks in Singapore and Canada, although this will likely continue to expand globally.
  • CVE-2026-16723 was discovered by FearsOff, an offensive security company, which published a earlier this month.
  • Alibaba confirmed the critical severity of the vulnerability and warned that it is exploitable on 'the most common Spring Boot deployment model.'
  • The only deployment prerequisite is that the target runs as a Spring Boot executable fat-jar (i.e., launched via java -jar xxx.jar).
Fastjson 1.x RCE vulnerability exploits threaten Java projects as attacks escalate; GCSA warns of high severity risk.
Risky Business Newsletters
Fastjson 1.x RCE vulnerability exploits threaten Java projects as attacks escalate; GCSA warns of high severity risk.

Threat actors are exploiting a vulnerability in Alibaba's Fastjson, a popular Java library for JSON data.

Alibaba GroupCybersecurity FieldFastjson
2026-07-27
TL;DR by CuriousCats.ai
  • Threat actors are exploiting a vulnerability in Alibaba's Fastjson, one of the Java ecosystem's most popular libraries for working with JSON-formatted data.
  • Active exploitation began last week, a day after details about the security flaw were revealed by a cybersecurity firm.
  • The GCSA Global Cybersecurity Alliance released a report detailing a Fastjson 1.2.83 RCE exploit reproduced across multiple JDK versions.
  • The vulnerability is rated as high severity: the attack vector is network-remote, requires no user interaction, and the impact on confidentiality, integrity, and availability is all rated high.
  • The attacks target CVE-2026-16723, a vulnerability that can enable unauthenticated remote code execution attacks against Java projects that use the Fastjson library as a component.
  • The vulnerability works in the library's default configuration and in its most common deployment model, as a Spring Boot executable component.
Become the most informed
person in the room.
Personal AI agents scanning 100,000+ sources — news, video, and social media — delivered every morning.
Download the App Go to CuriousCats.ai
🇺🇸 US🇮🇳 India🇬🇧 UK🇨🇦 Canada🇸🇬 Singapore
If you liked this, you’ll love your CuriousCats brief.
News, videos, opinions and more — without the noise.
Get CuriousCats