Hackers Target Organisations Using Critical FastJson Flaw that Enables Remote Code Execution

Hackers are targeting organisations with a critical security flaw in FastJson, an open-source Java library. The flaw can let attackers run code on affected systems without logging in.

The vulnerability affects FastJson versions 1.2.68 through 1.2.83, including the final FastJson 1.x release. The flaw carries a CVSS score of 9.0, which places it in the critical category.

Security researchers have already reported exploitation activity linked to the vulnerability. ThreatBook said it detected the flaw being exploited in the wild after researchers disclosed it.

Imperva also reported attacks against organisations in several industries. Those sectors include finance, healthcare, computing, and retail.

Hackers Exploit FastJson Flaw

The vulnerability is tracked as CVE-2026-16723. It affects FastJson versions 1.2.68 through 1.2.83. The official FastJson advisory says the issue can work under the library’s default settings.

Attackers do not need to enable AutoType to exploit the flaw. They also do not need a third-party gadget class in the application.

The attack affects certain Spring Boot applications that run as executable fat-JAR files. This setup is a common way to deploy Spring Boot software. The FastJson maintainers said they verified the attack chain across Spring Boot 2.x, 3.x, and 4.x. They also tested it with JDK versions 8, 11, 17, and 21. (GitHub)

FastJson handles data between Java software and JSON, a common format used to exchange information. The flaw involves the way FastJson processes type information supplied through attacker-controlled data.

A specially created request can abuse that process under the affected deployment setup. This can allow an attacker to execute code on the vulnerable system. (GitHub).

Security researcher Kirill Firsov of FearsOff Cybersecurity discovered the vulnerability. The FastJson maintainers published their security advisory on July 21, 2026. The advisory lists FastJson 1.2.83 as affected, even though it was the final release in the 1.x branch. (GitHub).

The National Vulnerability Database also lists versions 1.2.68 through 1.2.83 as affected. NVD records the vulnerability as a critical issue with a 9.0 score assigned by Alibaba. The database describes remote code execution as the main security impact.

Security Firms Report Attack Activity

ThreatBook reported active exploitation shortly after the vulnerability became public. The company said its threat detection platform had captured exploitation attempts involving the FastJson flaw. ThreatBook advised organisations using affected versions without SafeMode to treat remediation as urgent.

Imperva also reported attacks linked to CVE-2026-16723. The security company said the activity targeted organisations across finance, healthcare, computing, and retail.

Most of the activity observed by Imperva focused on organisations in the United States. The company also saw smaller amounts of activity involving Singapore and Canada. The compromised networks could end up on dark web markets, and hackers have been offering corporate network and airport access for sale.

The reports show that attackers began looking for vulnerable systems soon after public disclosure. The activity also raises concerns for organisations that may not know they use FastJson.

Some Java software can include FastJson as an indirect dependency through other software packages. Organisations therefore need to check both direct and indirect software components.

The attack activity is significant because the vulnerability does not depend on AutoType being enabled. It also does not require a suitable third-party gadget class. Those conditions can remove protections that affected organisations may have relied upon when defending older FastJson deployments.

The vulnerability’s status also requires careful wording. ThreatBook and Imperva have reported exploitation activity, but the available reports do not identify specific victims.

The reports therefore show attack activity without proving that every targeted organisation suffered a successful compromise.

Organisations Urged to Take Action

Organisations running affected FastJson versions should first identify where the library appears in their Java systems. They should also check whether those systems use the affected Spring Boot executable fat-JAR deployment model.

Security teams should review their logs for unusual requests and activity involving exposed applications. The official FastJson advisory recommends enabling SafeMode as an immediate protection measure.

Organisations should also consider using a restricted non-autotype build where suitable for their software. The maintainers recommend moving to FastJson 2.x, which the advisory lists as unaffected.

Imperva also urged organisations to review their Java and Spring Boot environments. The company recommended checking direct and indirect FastJson dependencies during that review.

Security teams should also watch for suspicious JSON requests and other unusual behaviour from affected systems. The immediate challenge comes from the affected FastJson 1.x branch.

FastJson 1.2.83 was its final 1.x release, and the current advisory does not provide a fixed 1.x version. The recommended path, therefore, focuses on SafeMode, other available protections, and migration to FastJson 2.x. 

With attackers already probing for vulnerable systems, organisations using affected FastJson versions face a serious security concern.

Security teams should identify exposed systems and apply the recommended protections without delay. They should also plan their move away from the affected FastJson 1.x branch.