CVE-2026-16723: Alibaba Fastjson — Unpatched RCE Threat Emerges (July 2026)

CVE-2026-16723 — Alibaba Fastjson

CVE-2026-16723 is a high-severity remote code execution vulnerability in Alibaba’s Fastjson 1.x library. The flaw is actively exploited in the wild and currently lacks an official patch for the 1.x branch. Attackers can achieve arbitrary code execution with the privileges of the Java process, posing a significant risk of full system compromise. No confirmed breaches have been publicly disclosed, but exploit attempts are ongoing across multiple sectors.

Attack Vector

The vulnerability targets Spring Boot fat-JAR applications using Fastjson 1.x. Unauthenticated attackers exploit unsafe deserialization in Fastjson to deliver malicious payloads, resulting in arbitrary code execution. Successful exploitation requires the application to process attacker-controlled JSON input with Fastjson in a default or unsafe configuration. No specific IOCs have been published, but exploitation has been observed in the wild, particularly against US-based organizations.

Who Is at Risk

Any organization running Java applications—especially Spring Boot fat-JAR deployments—using Fastjson 1.x is at risk. Sectors affected include financial services, healthcare, computing, and retail, with notable exposure among Alibaba’s own infrastructure and US-based enterprises. No patch is available for Fastjson 1.x; Fastjson2 is not affected.

Patch & Mitigate

• Patch: No official patch for Fastjson 1.x. Immediate migration to Fastjson2 is strongly recommended.
• Workaround: Enable SafeMode in Fastjson 1.x to restrict deserialization features and reduce attack surface.
• Detect: Monitor application logs for unexpected deserialization errors, anomalous process spawns from Java applications, and suspicious inbound JSON payloads targeting Fastjson endpoints.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed Fastjson endpoints to gain entry.
• TA0005 — Defense Evasion: Malicious payloads are crafted to bypass weak deserialization controls and evade detection.

Source: https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html