A critical vulnerability in the popular Fastjson library is being exploited by threat actors to execute arbitrary code on vulnerable servers, posing a significant risk to data confidentiality, integrity, and availability. The issue affects all deployments running as Spring Boot executable fat-jars, which are widely used in various sectors, including business, computing, financial services, healthcare, and retail.
Fastjson is a Java library developed by Alibaba for JSON serialization and deserialization. The vulnerability, tracked as CVE-2026-16723 with a CVSS score of 9, allows an attacker to bypass restrictions and execute malicious code without any authentication or user interaction. This is made possible because the library treats the presence of a @JSONType annotation as a trust signal during type resolution, allowing attackers to manipulate resource lookups and annotations to reach a path for code execution.
The vulnerability affects Fastjson versions 1.2.68 up to and including 1.2.83, which are no longer supported. However, threat actors have been observed exploiting the issue against organizations in various sectors across the US, Singapore, and Canada. Most attacks originated from browser impersonators, with around 30% coming from tools written in Ruby and Go.
Given that there is no official patch available for the exploited vulnerability, affected organizations are advised to migrate to Fastjson 2.x as soon as possible. If migration is not feasible, they should consider enabling SafeMode or blocking POST and JSON requests containing specific strings. Imperva notes that exposed applications running vulnerable configurations should be treated as high-priority remediation targets due to the ease of exploitation.
The ease with which this vulnerability can be exploited makes it a significant concern for organizations using Fastjson in their deployments. As threat actors continue to target vulnerabilities in widely used libraries and frameworks, it is essential for developers and system administrators to stay vigilant and take proactive measures to prevent attacks. In this case, taking immediate action to migrate or patch affected systems will help prevent potential breaches.
One key takeaway from this incident is the importance of keeping software up-to-date and migrating to newer, supported versions when possible. This can often be the most effective way to protect against vulnerabilities like CVE-2026-16723. Additionally, regularly reviewing and updating security configurations, such as enabling SafeMode or blocking malicious requests, can help prevent attacks from succeeding even if a vulnerability is present.
Source: SecurityWeek — 2026-07-28