Critical Unpatched Fastjson Vulnerability Exploited in Cyber Attacks

Post Views: 8

Threat actors have been leveraging a critical remote code execution flaw in the Fastjson library to compromise systems, according to cybersecurity researchers.

Unpatched Fastjson Vulnerability Exploited in Attacks

Threat actors have been leveraging a critical remote code execution flaw in the Fastjson library to compromise systems, according to cybersecurity researchers.

Fastjson, a widely used Java-based JSON processing tool developed by Alibaba, is vulnerable to exploitation due to a flaw affecting its default configuration. The issue, designated CVE-2026-16723 with a CVSS score of 9, targets deployments utilizing the Spring Boot executable fat-jar format, which is the most common deployment method. The vulnerability allows attackers to execute arbitrary code on affected servers without requiring authentication or user interaction.

Affected Versions

Alibaba’s advisory highlights that the flaw is exploitable under default settings, eliminating the need for AutoType activation or external gadget libraries. This makes the vulnerability particularly dangerous, as it bypasses standard security measures. The affected versions include Fastjson 1.2.68 through 1.2.83, which are no longer supported. Versions 2.x are not impacted.

Exploitation Method

Exploitation occurs through malicious JSON files containing a crafted @type value, which manipulates the library’s type resolution process. Attackers exploit the presence of the @JSONType annotation, treating it as a trust signal during object instantiation. This combination of resource lookup and annotation-based trust enables bypassing protections designed to block unauthorized code execution.

Security firms have observed active exploitation targeting organizations across multiple industries, including finance, healthcare, retail, and technology, with incidents reported in the U.S., Singapore, and Canada. Imperva notes that the majority of attacks originate from browser impersonators, while 30% involve tools written in Ruby and Go. No official patch exists for the vulnerability, prompting recommendations to migrate to Fastjson 2.x.

Remediation Recommendations

Organizations unable to upgrade should enable SafeMode, block specific JSON payloads, or use a modified build that removes AutoType-related code. The lack of authentication requirements and minimal attack complexity means exposed systems running vulnerable configurations require immediate remediation. The flaw underscores the risks of using outdated software and highlights the importance of proactive security measures. Attackers can exploit the vulnerability to gain full control over affected servers, compromising data confidentiality, integrity, and availability.