A critical remote code execution (RCE) vulnerability, identified as CVE-2026-16723, has been discovered in Fastjson, a widely used JSON processing library for Java applications. This flaw affects versions 1.2.68 through 1.2.83 and is currently being actively exploited by attackers targeting organizations in the United States.
Fastjson, developed by Alibaba, is an open-source library that facilitates the serialization and deserialization of Java objects to and from JSON. The vulnerability is particularly concerning for applications deployed using Spring Boot’s executable fat JARs across various versions, including Spring Boot 2.x, 3.x, and 4.x, and JDK versions 8, 11, 17, and 21. Exploitation can occur when an attacker sends a specially crafted JSON payload to a vulnerable application, potentially leading to arbitrary code execution without authentication.
Security firms have observed active exploitation of this vulnerability across multiple industries, including financial services, healthcare, retail, computing, and business services. While the majority of attacks have been concentrated in the United States, there have also been reports of incidents in Singapore and Canada, with expectations of further global spread as public proof-of-concept exploits become more accessible.
One of the most alarming aspects of CVE-2026-16723 is that it can be exploited under Fastjson’s default configuration. Attackers do not need to enable AutoType or rely on third-party gadget classes, making the attack vector more accessible and dangerous. The vulnerability allows remote attackers to execute arbitrary commands with the same permissions as the Java application, potentially leading to data theft, deployment of malware, or complete control over the affected server.
Given the severity of this vulnerability and the active exploitation in the wild, organizations using affected versions of Fastjson are urged to take immediate action. Enabling Fastjson’s SafeMode is a critical first step to mitigate the risk. This can be achieved by setting the system property -DFastJson.parser.safeMode=true or programmatically with ParserConfig.getGlobalInstance().setSafeMode(true). Additionally, organizations should conduct thorough code reviews to identify and update any dependencies on vulnerable versions of Fastjson.
It’s important to note that Fastjson 1.x is no longer actively maintained, and no official patches are available for this vulnerability. Therefore, migrating to Fastjson 2.x is strongly recommended. Fastjson 2.x is not affected by CVE-2026-16723 due to its architectural changes, including an allowlist-first approach for polymorphic deserialization and the absence of the resource probing mechanism present in the 1.x versions.
In light of this critical vulnerability, organizations must prioritize the security of their Java applications by implementing the recommended mitigations and considering an upgrade to Fastjson 2.x. Proactive measures are essential to protect against potential exploitation and to maintain the integrity and security of systems relying on this widely used library.
