Hackers Exploit FastJson Zero-Day Flaw Targeting US Organizations
Hackers are actively exploiting a critical zero-day vulnerability in FastJson, an open-source Java library developed by Alibaba, that enables remote code execution without requiring user interaction or elevated privileges. Security firms ThreatBook and Imperva confirm that the attacks are almost entirely focused on U.S.-based organizations spanning financial services, healthcare, retail, computing, and other sectors, with limited activity also observed in Singapore and Canada. The scope of targets is expected to broaden globally as the campaign continues.
The flaw, tracked as CVE-2026-16723, resides in the library's type-resolution logic, which processes attacker-controlled resource lookups before enforcing AutoType restrictions. This allows attackers to load and execute malicious classes through @type processing in Spring Boot fat-JAR deployments without needing AutoType enabled or third-party gadget chains. The vulnerability affects FastJson versions 1.2.68 through 1.2.83, and Alibaba confirms it is exploitable on the most common Spring Boot deployment model used across enterprise environments.
No fix is currently available for the vulnerability, leaving organizations at immediate risk. Alibaba notes that simply specifying a target class during deserialization does not mitigate the issue, as attackers can embed payloads within Object or Map fields. The company does point out that the newer fastjson2 library is unaffected because it uses an allowlist-first model for polymorphic deserialization and does not rely on the @JSONType annotation as a trust signal, offering a safer alternative for developers.