Critical Fastjson 1.x Zero-Day RCE Exploited in the Wild

#cybersecurity #infosec

Summary

Alibaba's Fastjson 1.x library is vulnerable to a critical zero-day remote code execution flaw (CVE-2026-16723) that is currently exploited in the wild against Spring Boot applications. The vulnerability allows unauthenticated attackers to run arbitrary code by bypassing default security configurations through crafted JSON requests.

Take Action:

If you run Java apps using Fastjson 1.x (versions 1.2.68–1.2.83) as Spring Boot fat-JARs, your applications are actively attacked, and there is no patch for the 1.x branch. Migrate to Fastjson2 ASAP. If you can't migrate, immediately enable SafeMode by adding -Dfastjson.parser.safeMode=true to your JVM settings and monitor your logs for unusual @type values or unexpected outbound connections from Java.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines