🔴 Critical | Source: The Hacker News
A critical remote code execution vulnerability (CVE-2026-16723) in Fastjson 1.x, Alibaba’s widely-used Java JSON library, is being actively exploited in the wild with no patch currently available. Attackers can send a crafted JSON request to vulnerable Spring Boot applications and execute arbitrary code without authentication, inheriting the full privileges of the Java process. The absence of a fix makes this particularly dangerous for any organisation running Fastjson 1.x in production.
Security Architect’s Take: Immediately audit your application estate for Fastjson 1.x dependencies — check direct and transitive Maven/Gradle dependencies using tools such as OWASP Dependency-Check or Snyk. Where Fastjson 1.x cannot be replaced with a patched alternative or migrated to Fastjson 2.x, apply compensating controls: deploy WAF rules targeting malicious JSON payloads, restrict network access to affected services, and ensure Java processes run with least-privilege service accounts.
Original advisory: Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available