SECURITY researchers have observed active exploitation of a critical remote code execution flaw in the popular Fastjson Java library, tracked as CVE-2026-16723, affecting all releases from 1.2.68 to 1.2.83. The vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable servers by sending specially crafted JSON payloads, posing a direct threat to the confidentiality and integrity of affected systems. SecurityWeek highlighted the issue after detecting attacks that have already reached organisations in the healthcare and finance sectors according to their reporting.
The flaw resides in the library’s deserialization process, where Fastjson fails to properly validate input before instantiating objects. By exploiting polymorphic typing, an attacker can force the parser to load malicious classes and execute their code with the same privileges as the application. The issue carries a CVSS score of 9.0, reflecting its high impact and low attack complexity. No authentication is required, and the exploit can be launched remotely over HTTP or any channel that passes JSON data to the vulnerable component.
All versions of the Fastjson 1.x line between 1.2.68 and 1.2.83 are vulnerable, while the maintainer has not released a patch for this specific release line because the 1.x branch is now archived. Users are advised to migrate to the actively maintained Fastjson 2.x series, which does not contain the vulnerable code path, or to enable the library’s SafeMode feature as an interim protection. The primary advisory from the project’s wiki outlines these mitigation steps in detail here.
Since the first sighting on 25 July 2026, the flaw has been used in a series of attacks that target exposed Java web applications, with observed payloads attempting to spawn reverse shells and deploy cryptocurrency miners. Although no specific threat actor has been publicly linked to the campaign, the timing and targeting suggest financially motivated groups seeking to monetise access in health and financial environments. SecurityOnline noted that millions of internet‑facing instances could be at risk, urging immediate verification of asset inventories in their report.
The absence of a fix for the legacy 1.x line leaves organisations that rely on older Java applications in a difficult position, as many internal systems continue to depend on the outdated library for JSON processing. This situation mirrors past incidents where unpatched components persisted in critical infrastructure, amplifying the potential impact of a single vulnerability. The critical severity score and the ease of exploitation mean that delaying action could lead to widespread compromise, especially in sectors where data sensitivity and regulatory requirements are high.
Defenders should first identify any Fastjson 1.x instances within their environment, prioritising those that accept JSON from untrusted sources. Where possible, upgrade to Fastjson 2.x immediately; if an upgrade cannot be performed, enable SafeMode to restrict auto‑type handling and block dangerous classes. Network‑level controls such as restricting outbound connections from application servers and monitoring for unusual process spawns can help detect exploitation attempts. Finally, ensure that logging is enabled for deserialization errors and review alerts regularly to catch any early signs of malicious activity.