RCE-уязвимость в Fastjson используется в атаках
Reported exploitedFastjsonOur summary
Hackers are actively exploiting a critical remote code execution (RCE) vulnerability in the popular Java library Fastjson, identified as CVE-2026-16723. This flaw allows unauthenticated attackers to execute arbitrary code remotely without user interaction. The issue affects Fastjson versions 1.2.68 through 1.2.83 when used in Spring Boot applications packaged as executable fat JARs. Attackers can exploit this by sending malicious JSON payloads that trigger class loading from external sources, bypassing standard AutoType restrictions. Alibaba has released version 1.2.84 to address the problem, and users are advised to update immediately or enable SafeMode as a temporary mitigation.
Хакер (xakep.ru) publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.