Attackers exploit critical Fastjson 1.x RCE with no patch available

Attackers are actively exploiting a critical Fastjson 1.x remote code execution vulnerability with no patch available as of today, according to The Hacker News. Security firms ThreatBook and Imperva report the flaw allows unauthenticated JSON requests to execute code with the Java process's privileges in susceptible Spring Boot applications. The issue is tracked as CVE-2026-16723 and carries an Alibaba-assigned CVSS score of 9.0.

Fastjson, Alibaba’s widely used JSON library for Java, underpins many Spring Boot services, heightening immediate exposure, The Hacker News adds. ThreatBook and Imperva say they are already seeing in-the-wild targeting, and no vendor patch for the 1.x line has been released. Watch for an official advisory or fixes from Alibaba, defensive guidance for Spring Boot deployments, and any indicators of compromise shared by ThreatBook and Imperva. [Developing. This article will be updated.]