Cybercriminals are currently taking advantage of a flaw in the FastJson open-source Java library, which enables remote code execution without the need for user interaction or elevated permissions.
This security vulnerability impacts FastJson versions 1.2.68 to 1.2.83 and is being utilized in attacks against various entities in the United States.
The malicious activities were detected last week by the security firm ThreatBook, and researchers from the business protection company Imperva have verified that it is “aimed at a diverse array of organizations across sectors such as Financial Services, Healthcare, Computing, Retail, Business, and more.”
According to Imperva, “The majority of the attacks are currently focused on organizations based in the U.S., with a few incidents reported in Singapore and Canada, although this trend is likely to expand globally.”
FastJson, an open-source Java library created by Alibaba, is utilized for converting Java objects to JSON and vice versa.
The project boasts 25,600 stars and 6,400 forks on GitHub and is particularly common in Chinese enterprise software and projects developed on Alibaba’s platform.
The vulnerability, identified as CVE-2026-16723, was discovered by FearsOff, an offensive security firm, which released a technical analysis earlier this month.
The researchers indicate that the issue arises from the library’s type-resolution logic, which allows attacker-controlled resource lookups before enforcing AutoType restrictions. This creates an opportunity for remote code execution in Spring Boot fat-JAR deployments.
By exploiting @type processing, the researchers managed to load and execute harmful classes without needing AutoType enabled or third-party gadget chains.
No fix is currently available.
In its security bulletin, Alibaba acknowledged the critical nature of the vulnerability and cautioned that it can be exploited on “the most prevalent Spring Boot deployment model.”
According to Alibaba’s security advisory, “The only requirement for deployment is that the target operates as a Spring Boot executable fat-jar (i.e., launched via java -jar xxx.jar).”
The vendor also points out that specifying a target class during deserialization does not alleviate the risk of CVE-2026-16723, as attackers can insert malicious payloads within ‘Object’ or ‘Map’ fields.
The flawed type-resolution logic is absent in fastjson2, which employs an allowlist-first approach for polymorphic deserialization and does not depend on the @JSONType annotation as a trust signal.
Additionally, FastJson versions 1.2.60 and earlier, as well as any non-fat-JAR deployments, are not affected.
Developers using a version within the vulnerable range are strongly advised to promptly enable SafeMode or transition to a non-affected build.
At present, no fix has been released for CVE-2026-16723. Imperva has also pointed out that FastJson 1.x is no longer actively maintained, making it improbable that it will receive a security update.
Test every layer before attackers do.
Security teams record 54% of successful attacks but only alert on 14%. The remainder navigate through your environment unnoticed.
The Picus whitepaper illustrates how breach and attack simulation can test your SIEM and EDR rules to prevent threats from evading detection.
Get the whitepaper.
Source: Original article
