US Firms Under Attack as Hackers Exploit Critical Vulnerability in FastJson Library
Hackers have been targeting US-based organizations with a devastating zero-day attack that leverages a critical vulnerability in the widely used FastJson Java library. The malicious activity, which has been observed by security researchers at ThreatBook and Imperva, affects various industries including finance, healthcare, retail, and more.
The vulnerability, known as CVE-2026-16723, is a remote code execution (RCE) flaw that allows attackers to execute arbitrary code without the need for user interaction or elevated privileges. This is particularly concerning because it can be exploited by simply sending malicious data to an affected application, making it a highly potent attack vector.
FastJson, developed by Alibaba, is an open-source Java library used for serializing and deserializing Java objects to JSON and vice versa. With over 25,600 stars and 6,400 forks on GitHub, the project has become a staple in Chinese enterprise software and projects built on Alibaba’s platform. However, its widespread adoption also makes it a prime target for attackers.
Researchers at FearsOff discovered the vulnerability earlier this month, explaining that the flaw stems from the library’s type-resolution logic. This logic performs attacker-controlled resource lookups before enforcing AutoType restrictions, creating an opening for remote code execution in Spring Boot fat-JAR deployments. By abusing @type processing, attackers can load and execute malicious classes without requiring third-party gadget chains or AutoType enabled.
The severity of this vulnerability is underscored by Alibaba’s security advisory, which confirms that it is exploitable on the most common Spring Boot deployment model. Moreover, specifying a target class during deserialization does not mitigate CVE-2026-16723, as attackers can embed malicious payloads within ‘Object’ or ‘Map’ fields.
While developers using affected versions are urged to immediately enable SafeMode or switch to a non-impacted build, there is currently no fix available for CVE-2026-16723. Furthermore, FastJson 1.x is no longer actively maintained, making it unlikely that the library will receive a security update.
In light of this vulnerability, security teams must remain vigilant and ensure that their applications are regularly tested for vulnerabilities like these. This is especially crucial given the statistics from Picus, which show that security teams log only 14% of successful attacks after they occur. Regular breach and attack simulation tests can help identify weaknesses before attackers do, allowing organizations to stay one step ahead of malicious actors.
As the situation with CVE-2026-16723 continues to unfold, it is essential for developers and security professionals alike to take proactive steps in protecting their applications from this critical vulnerability. By doing so, they can prevent potential data breaches and maintain the integrity of their systems.
Source: Bleeping Computer — 2026-07-27