Attackers actively exploit CVE-2026-16723, a critical remote code execution flaw in Alibaba's Fastjson JSON library for Java. ThreatBook and Imperva confirmed the exploitation campaigns targeting Spring Boot applications running vulnerable versions of Fastjson 1.x.
The vulnerability allows unauthenticated attackers to execute arbitrary code with the privileges of the affected Java process through malicious JSON requests. Alibaba assigned the flaw a CVSS score of 9.0, reflecting its severity across enterprise deployments.
No patch currently exists for Fastjson 1.x versions. Organizations using this library face immediate risk, particularly those exposing Spring Boot applications to untrusted network traffic. The Java ecosystem widely adopted Fastjson for JSON serialization and deserialization, making the attack surface extensive.
Fastjson's deserialization mechanisms process JSON data in ways that permit gadget chain attacks. Attackers craft malicious JSON payloads that trigger object instantiation and method invocation during parsing, leading to code execution. The unauthenticated nature of this vulnerability means attackers need no valid credentials to launch attacks.
Defensive measures include network isolation of affected applications, restricting JSON input sources, and implementing Web Application Firewall rules to block suspicious JSON patterns. Organizations should immediately inventory systems running Fastjson 1.x and assess exposure. Upgrading to patched versions when available becomes critical once Alibaba releases fixes.
For Fastjson 2.x users, the risk profile differs and warrants separate assessment. The active exploitation reported by both ThreatBook and Imperva indicates attackers profit from this flaw at scale. Java environments processing untrusted JSON input require urgent attention.