Fastjson 1.x RCE Flaw Actively Exploited, No Patch Available

Security researchers have identified active exploitation of a critical remote code execution vulnerability in Fastjson 1.x, a popular JSON library for Java applications. Tracked as CVE-2026-16723, this flaw allows unauthenticated attackers to execute arbitrary code on vulnerable systems running Spring Boot applications.

The vulnerability has been assigned a CVSS score of 9.0 by Alibaba, indicating a severe risk level. What makes this particularly concerning is that no official patch has been released yet, leaving organizations exposed to potential attacks. Security firms ThreatBook and Imperva have confirmed that threat actors are already leveraging this flaw in real-world campaigns.

Technical Impact and Attack Vector

• The vulnerability enables remote code execution through specially crafted JSON requests in Spring Boot applications
• No authentication is required to exploit this flaw, making it highly accessible to attackers
• Successful exploitation grants attackers the same privileges as the underlying Java process
• The attack chain specifically targets applications using Fastjson 1.x for JSON processing
• Impact includes complete system compromise, data theft, and potential lateral movement within networks

Immediate Recommendations

• Audit all Java applications for Fastjson 1.x dependencies immediately
• Consider temporary mitigation measures such as input validation and network segmentation
• Monitor application logs for suspicious JSON parsing activities or unusual outbound connections
• Plan for emergency patch deployment once an official fix becomes available
• Implement runtime application protection solutions to detect exploitation attempts

Sources

• Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available