FastJson RCE Zero-Day Exploited Against US Organisations

Hackers are actively exploiting a FastJson RCE zero-day that can give them remote code execution on vulnerable Java applications.

The flaw, tracked as CVE-2026-16723, affects FastJson versions 1.2.68 through 1.2.83. Researchers have observed attacks against organisations in the United States across financial services, healthcare, computing, retail and other sectors.

A small number of attacks have also targeted organisations in Singapore and Canada. However, researchers expect the campaign to expand further.

Vulnerability affects common Spring Boot deployments

FastJson is an open-source Java library that serialises Java objects into JSON and converts JSON data back into Java objects. Alibaba developed the project, which remains widely used in enterprise software.

According to Alibaba, attackers can exploit CVE-2026-16723 in the most common Spring Boot deployment model. A vulnerable application must run as an executable Spring Boot fat JAR, launched through a command such as java -jar.

The attack does not require user interaction or elevated privileges.

Researchers found that the issue lies in FastJson’s type-resolution logic. The library can perform attacker-controlled resource lookups before enforcing its AutoType restrictions.

This creates a route for attackers to load and execute malicious classes remotely.

Attackers can bypass AutoType restrictions

The FastJson RCE zero-day involves abuse of the library’s @type processing.

Researchers showed that attackers could execute malicious code even when AutoType was disabled. They also did not need third-party gadget chains, which often play a role in Java deserialisation attacks.

Specifying a target class during deserialisation does not protect an affected application. Attackers can place malicious payloads inside fields that use the Object or Map types.

That makes the flaw especially concerning for organisations that process untrusted JSON data through vulnerable FastJson builds.

No patch is currently available

Alibaba has confirmed the critical severity of CVE-2026-16723, but it has not released a patch.

FastJson 1.x is no longer actively maintained, so a security update may never arrive for the affected branch.

The vulnerability does not affect FastJson 1.2.60 or earlier. It also does not affect deployments that do not use the Spring Boot fat-JAR model.

Fastjson2 is not vulnerable because it uses an allowlist-first approach to polymorphic deserialisation. It also does not treat the @JSONType annotation as a trust signal.

Developers should mitigate exposure now

Developers using FastJson versions 1.2.68 through 1.2.83 should act immediately.

Alibaba recommends enabling SafeMode or moving to a non-affected build. Where possible, organisations should migrate away from FastJson 1.x and adopt Fastjson2 or another supported JSON library.

Teams should also identify any internet-facing Spring Boot fat-JAR applications that process untrusted data. They should review logs for unusual deserialisation activity, unexpected outbound connections and suspicious class-loading behaviour.

With active exploitation already underway, delaying mitigation could leave vulnerable applications open to a full server compromise.