CVE Tools
Track your stack

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

The Hacker NewsBy The Hacker News

Reported exploitedFastjsonJava libraries

Our summary

Attackers are actively exploiting a critical remote code execution (RCE) vulnerability in Fastjson, Alibaba's widely used Java JSON library. Tracked as CVE-2026-16723, this flaw affects versions 1.2.68 through 1.2.83 and enables unauthenticated attackers to execute arbitrary code under certain conditions involving Spring Boot applications. As of July 25, no official patch for the 1.x branch has been released, leaving users vulnerable unless they apply mitigations like enabling SafeMode or upgrading to Fastjson2.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. Хакер (xakep.ru)RCE-уязвимость в Fastjson используется в атакахCVE-2026-16723
  2. Risky Business NewsSrsly Risky Biz: Chipping Away at Chinese AI RisksCVE-2026-16723
  3. SecurityWeekUnpatched Fastjson Vulnerability Exploited in AttacksCVE-2026-16723
  4. The Hacker NewsAttackers Exploit Arista VeloCloud Orchestrator Command Injection FlawCVE-2026-16723
  5. BleepingComputerHackers target US firms in FastJson RCE zero-day attacksCVE-2026-16723
  6. Risky Business NewsA JSON RCE bug is about to rock the Java worldCVE-2026-16723

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store