CVE-2026-16723: Alibaba FastJson — Zero-Day RCE Hits Multiple Sectors (June 2026)

CVE-2026-16723 — Alibaba FastJson

CVE-2026-16723 is a critical zero-day vulnerability in the Alibaba FastJson Java library (versions 1.2.68 to 1.2.83) that allows remote code execution (RCE) without user interaction or elevated privileges. This flaw is under active exploitation, with confirmed attacks targeting U.S.-based organizations. No vendor patch is currently available.

Attack Vector

Attackers exploit FastJson's deserialization logic by sending crafted JSON payloads to vulnerable endpoints. Successful exploitation enables arbitrary code execution on the target system. No authentication or special privileges are required, increasing the risk of automated, mass exploitation. Indicators of compromise (IOCs) are not detailed, but defenders should monitor for suspicious JSON input and unexpected process launches from Java applications.

Who Is at Risk

All systems running FastJson versions 1.2.68 through 1.2.83 are vulnerable. Confirmed victims include organizations in the financial services, healthcare, retail, and computing sectors, with Imperva reporting affected clients. Alibaba has not released a fix, and exploitation is focused on North American targets.

Patch & Mitigate

• Patch: No official patch is available as of June 2026. Monitor Alibaba advisories for updates.
• Workaround: Restrict or disable FastJson deserialization where possible. Validate and sanitize all incoming JSON data. Consider reverting to a non-vulnerable FastJson version if feasible.
• Detect: Review application and web server logs for anomalous JSON payloads, unexpected Java process executions, and external callbacks following JSON deserialization.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers deliver malicious JSON payloads to exposed endpoints.
• TA0005 — Defense Evasion: Exploitation occurs without user interaction, bypassing standard authentication controls.

Source: https://www.hendryadrian.com/hackers-target-us-firms-in-fastjson-rce-zero-day-attacks/