US Companies Under Attack as Hackers Exploit Vulnerability in Popular Java Library
A critical vulnerability is being actively exploited by hackers to target US-based organizations, with a few reported cases in Singapore and Canada. The issue lies in FastJson, an open-source Java library used for serializing data between Java objects and JSON formats. This widely-used tool has been exploited through a remote code execution (RCE) zero-day attack, allowing attackers to execute malicious code without requiring user interaction or elevated privileges.
FastJson is developed by Alibaba and has over 25,600 stars on GitHub, indicating its popularity among developers. However, researchers at Imperva have confirmed that the vulnerable versions of the library – 1.2.68 through 1.2.83 – are being targeted in attacks across various industries, including finance, healthcare, retail, and business services. The hackers appear to be focusing on US-based organizations, but experts warn that this could expand globally as more attackers become aware of the vulnerability.
The flaw, identified as CVE-2026-16723, stems from FastJson’s type-resolution logic, which allows attackers to perform unauthorized resource lookups before enforcing necessary security restrictions. This creates a path for executing malicious code in Spring Boot fat-JAR deployments. The researchers who discovered the issue explain that by abusing @type processing, hackers can load and execute malicious classes without requiring additional gadget chains or AutoType enabled.
Alibaba has confirmed the critical severity of the vulnerability and warned that it is exploitable on the most common Spring Boot deployment model. Unfortunately, no fix is currently available for the affected versions of FastJson, and the vendor notes that specifying a target class during deserialization does not mitigate the issue. The company also points out that the vulnerable type-resolution logic is not present in fastjson2, which uses an allowlist-first model for polymorphic deserialization.
Developers who use affected versions are advised to immediately enable SafeMode or switch to a non-impacted build. However, given that FastJson 1.x is no longer actively maintained, it’s unlikely that a security update will be issued. This highlights the importance of regularly monitoring and updating dependencies in software development projects.
To avoid falling victim to these types of attacks, security teams must prioritize testing and validation across all layers of their environment. By doing so, they can identify potential vulnerabilities before attackers do and ensure that their defenses are robust enough to detect and prevent such threats.
Source: Bleeping Computer — 2026-07-27