FastJson RCE Zero-Day Actively Targets Organizations 

Threat actors are actively exploiting a remote code execution (RCE) vulnerability in the FastJson Java library, placing organizations across multiple industries at risk.

The flaw affects FastJson versions 1.2.68 through 1.2.83 and enables attackers to execute malicious code without requiring user interaction, elevated privileges, or traditional Java deserialization gadget chains. 

Researchers have observed active attacks primarily targeting organizations in the United States, with additional activity reported in Singapore and Canada.

Key takeaways of the FastJson RCE

• Threat actors are actively exploiting CVE-2026-16723, a FastJson remote code execution vulnerability affecting versions 1.2.68 through 1.2.83.
• The vulnerability enables remote code execution without user interaction or elevated privileges in affected Spring Boot executable fat-JAR deployments.
• No security patch is currently available, and FastJson 1.x is no longer actively maintained, making migration and compensating controls important.
• Organizations should identify vulnerable FastJson deployments, enable SafeMode, and prioritize migration to fastjson2 or another supported JSON library.

FastJson RCE targets multiple industries 

ThreatBook first observed active exploitation of CVE-2026-16723 last week, prompting further investigation into the campaign.

Imperva later confirmed the activity, reporting that threat actors are targeting organizations across financial services, healthcare, retail, computing, business services, and several other industries.

According to Imperva, the attacks are currently focused almost entirely on U.S.-based organizations, with a smaller number of incidents observed in Singapore and Canada. 

Researchers expect the campaign to expand globally as awareness of the vulnerability and exploitation techniques spreads.

These attacks target FastJson, an open-source Java library developed by Alibaba that is widely used to serialize and deserialize JSON data in Java applications. 

The library remains widely used in enterprise environments, particularly in software built on Alibaba’s ecosystem and Chinese enterprise platforms, increasing the number of organizations that may be affected.  

How the FastJson RCE vulnerability works 

The vulnerability, CVE-2026-16723, stems from FastJson’s type-resolution logic, which performs attacker-controlled resource lookups before enforcing its AutoType security restrictions. 

This sequence creates an opportunity for remote code execution in applications deployed as Spring Boot executable fat-JARs, a common deployment model for Java applications.

By abusing FastJson’s @type processing, attackers can load and execute malicious Java classes without enabling AutoType or relying on the third-party gadget chains traditionally associated with Java deserialization attacks. 

Under the affected deployment conditions, successful exploitation requires no user interaction or elevated privileges.

Alibaba also warned that specifying a target class during deserialization does not eliminate the risk. 

Attackers can instead embed malicious payloads within Object or Map fields, allowing them to bypass that mitigation approach.

No patch available for FastJson CVE-2026-16723 

Alibaba has classified CVE-2026-16723 as a critical vulnerability and confirmed that it affects applications running as Spring Boot executable fat-JARs launched using the standard java -jar deployment model.

The company noted that the vulnerable type-resolution logic is not present in fastjson2, which uses an allowlist-first model for polymorphic deserialization and does not rely on the @JSONType annotation as a trust signal. 

Alibaba also confirmed that FastJson versions 1.2.60 and earlier, as well as applications that do not use Spring Boot fat-JAR deployments, are not affected.

Organizations running vulnerable FastJson 1.x releases face an additional challenge because no security patch is currently available. 

According to Imperva, the FastJson 1.x branch is no longer actively maintained, making it unlikely that Alibaba will release a fix for the vulnerability.

Until organizations can migrate to fastjson2 or another non-impacted build, Alibaba recommends enabling SafeMode immediately to reduce the risk of exploitation.

FastJson CVE-2026-16723 mitigation recommendations 

Because attackers are already exploiting CVE-2026-16723 in the wild, organizations should prioritize identifying any applications using affected FastJson versions and vulnerable deployment models.

Security teams should:

• Inventory all applications and third-party software using FastJson 1.2.68 through 1.2.83, identify Spring Boot fat-JAR deployments, and locate embedded dependencies using software composition analysis or SBOMs.
• Enable FastJson SafeMode immediately and prioritize migrating to fastjson2 or another supported JSON library, as no vendor patch is currently available.
• Reduce exposure by placing vulnerable applications behind network segmentation, reverse proxies, or API gateways and limiting untrusted JSON deserialization wherever possible.
• Monitor for suspicious deserialization activity, abnormal Java class loading, unexpected child processes, and unusual outbound network connections that could indicate exploitation.
• Update WAF and API security protections to inspect or block suspicious JSON payloads and anomalous @type processing where feasible.
• Apply least-privilege controls to Java applications and services to limit the impact of successful remote code execution.
• Test incident response plans for Java remote code execution scenarios to validate detection, containment, credential rotation, and recovery procedures before an attack occurs.

These steps can help reduce overall risk and limit the blast radius.

Bottom line

As active exploitation continues, security leaders should assume vulnerable FastJson deployments may already exist somewhere in their application portfolio, including third-party software. 

With no patch expected for FastJson 1.x, the priority shifts from waiting for a vendor fix to rapidly identifying affected assets, implementing compensating controls, and accelerating migration plans to reduce enterprise risk. 

As organizations work to reduce exposure from vulnerabilities like CVE-2026-16723, some are also reevaluating broader security strategies such as Zero Trust to help limit the impact of future attacks.