20260727-bleepingcomputer.com-5e606

< Back to index

Hackers target US firms in FastJson RCE zero-day attacks

Published:

27 July 2026 at 23:49:44

Alert date:

28 July 2026 at 00:01:16

Source:

bleepingcomputer.com

Zero-Day Vulnerabilities, Supply Chain & Dependencies, Web Technologies, Enterprise Applications

Hackers are actively exploiting a zero-day vulnerability in FastJson, a widely-used open-source Java library for JSON parsing. The vulnerability allows remote code execution (RCE) without requiring user interaction or elevated privileges, making it particularly dangerous. US-based firms are being targeted in these attacks. The flaw exists in the FastJson library itself, meaning any Java application using it may be at risk. The zero-day nature of the attacks indicates no patch was publicly available at the time of exploitation. Organizations using FastJson in their Java applications are urged to monitor for indicators of compromise and apply any available mitigations or patches promptly.

Technical details

CVE-2026-16723 is a critical remote code execution vulnerability in the FastJson open-source Java library (versions 1.2.68 through 1.2.83), developed by Alibaba. The flaw originates in the library's type-resolution logic, which performs attacker-controlled resource lookups before enforcing AutoType restrictions. This allows attackers to abuse @type processing to load and execute malicious classes without AutoType being enabled and without requiring third-party gadget chains. The vulnerability is exploitable on Spring Boot executable fat-JAR deployments (launched via 'java -jar xxx.jar') without user interaction or elevated privileges. Specifying a target class during deserialization does not mitigate the issue, as attackers can embed malicious payloads within 'Object' or 'Map' fields. The vulnerability does not affect fastjson2 (which uses an allowlist-first model), FastJson versions 1.2.60 and earlier, or non-fat-JAR deployments. FastJson 1.x is no longer actively maintained, making a patch unlikely. Attacks have primarily targeted US-based organizations across Financial Services, Healthcare, Computing, Retail, and Business sectors, with some activity observed in Singapore and Canada.

Mitigation steps:

1. Immediately enable SafeMode in FastJson if you are running versions 1.2.68 through 1.2.83. 2. Migrate to fastjson2, which uses an allowlist-first model for polymorphic deserialization and is not affected by this vulnerability. 3. If migration is not immediately possible, consider switching to a non-affected build (versions 1.2.60 or earlier, though these may have other issues and are also unmaintained). 4. Avoid relying on type specification during deserialization as a mitigation, as it does not prevent exploitation. 5. Monitor for anomalous outbound connections or unexpected class loading activity in Spring Boot fat-JAR applications. 6. Apply network-level controls and web application firewall (WAF) rules to detect and block exploit payloads targeting FastJson @type processing. 7. Track advisories from Alibaba and security vendors (ThreatBook, Imperva) for further guidance and any future patches.

Affected products:

FastJson (Alibaba) versions 1.2.68 through 1.2.83
Spring Boot fat-JAR deployments using affected FastJson versions