Executive Summary
A critical zero-day remote code execution (RCE) vulnerability in the FastJson Java library, tracked as CVE-2026-16723, is being actively exploited by threat actors targeting US-based organizations. This vulnerability affects FastJson versions 1.2.68 through 1.2.83, with exploitation observed primarily in Spring Boot fat-JAR deployments. The flaw enables attackers to execute arbitrary code on vulnerable systems by leveraging weaknesses in the library’s type resolution logic, even when security features such as AutoType are disabled. No official patch is available for the affected versions, and exploitation is ongoing, with opportunistic campaigns observed across multiple sectors including finance, healthcare, and retail. Organizations using vulnerable versions of FastJson are at immediate risk and should prioritize mitigation actions.
Threat Actor Profile
Current exploitation of CVE-2026-16723 is characterized by widespread, opportunistic activity rather than targeted campaigns by a specific advanced persistent threat (APT) group. Analysis from ThreatBook and Imperva indicates that multiple, likely unrelated, threat actors are leveraging public proof-of-concept (PoC) code to compromise exposed systems. The attackers demonstrate a high degree of technical proficiency in Java deserialization attacks and are actively scanning for vulnerable endpoints, particularly those deployed in US-based cloud and enterprise environments. The lack of a patch and the ease of exploitation have contributed to a rapid proliferation of attacks, with threat actors seeking to establish initial access for further lateral movement, data exfiltration, or ransomware deployment.
Technical Analysis of Malware/TTPs
The FastJson RCE vulnerability arises from a flaw in the library’s type resolution mechanism. Specifically, when deserializing JSON data, FastJson allows the use of the @type attribute to specify the Java class to instantiate. In affected versions, the library performs attacker-controlled resource lookups before enforcing AutoType restrictions, enabling remote code execution even when AutoType is disabled and without requiring third-party gadget chains.
Attackers craft malicious JSON payloads containing a @type field that references a class capable of executing arbitrary code. When this payload is processed by a vulnerable FastJson instance—commonly in a Spring Boot fat-JAR deployment—the type resolution logic loads and executes the attacker’s class, resulting in full compromise of the underlying server. This attack vector is particularly dangerous because it bypasses common mitigations and does not rely on external dependencies.
Observed tactics, techniques, and procedures (TTPs) include automated scanning for exposed endpoints, delivery of weaponized JSON payloads, and post-exploitation activities such as establishing reverse shells, deploying web shells, or downloading additional malware. In some cases, attackers have leveraged the initial access to pivot within compromised networks, escalate privileges, and exfiltrate sensitive data.
Exploitation in the Wild
Active exploitation of CVE-2026-16723 has been confirmed by multiple security vendors, including ThreatBook and Imperva. Attackers are targeting a broad range of US-based organizations, with additional activity observed in Singapore and Canada. The exploitation is not limited to a single sector; financial services, healthcare, computing, retail, and business verticals have all reported incidents.
Attackers are leveraging publicly available PoC code, which has accelerated the pace and scale of exploitation. The attacks are opportunistic, with threat actors scanning for any internet-facing application using a vulnerable version of FastJson. Once a target is identified, the attacker delivers a malicious JSON payload to trigger the RCE vulnerability. In several documented cases, exploitation has resulted in the deployment of web shells, cryptominers, and ransomware, as well as the theft of sensitive data.
Security researchers have observed a significant uptick in scanning and exploitation attempts following the public disclosure of the vulnerability and the release of PoC code by the researcher known as FearsOff. The lack of an official patch has further exacerbated the situation, leaving many organizations exposed.
Victimology and Targeting
The primary victims of these attacks are US-based enterprises and organizations that utilize Java applications with embedded FastJson libraries, particularly those deployed as Spring Boot fat-JARs. Sectors most affected include financial services, healthcare, retail, and technology, though the opportunistic nature of the attacks means that any organization with an exposed vulnerable endpoint is at risk.
Geographically, the majority of observed exploitation has targeted the United States, with additional campaigns detected in Singapore and Canada. The attacks are not limited to large enterprises; small and medium-sized businesses with limited patch management and security resources are also being targeted. The common denominator among victims is the use of outdated or unmaintained FastJson versions in public-facing applications.
Mitigation and Countermeasures
Organizations should take immediate action to mitigate the risk posed by CVE-2026-16723. The following countermeasures are recommended:
First, audit all Java applications for the use of FastJson versions 1.2.68 through 1.2.83, with particular attention to Spring Boot fat-JAR deployments. If possible, upgrade to fastjson2, which is not affected by this vulnerability due to its allowlist-first model, or migrate to an alternative, actively maintained JSON library.
If upgrading is not immediately feasible, enable SafeMode in FastJson to restrict deserialization of arbitrary types. Additionally, implement strict input validation to reject JSON payloads containing the @type attribute or other suspicious fields. Application-layer firewalls and runtime application self-protection (RASP) solutions can provide additional layers of defense by detecting and blocking malicious deserialization attempts.
Monitor application and server logs for indicators of compromise, such as unexpected process creation, outbound network connections, or the presence of malicious JSON payloads referencing attacker-controlled classes. Network segmentation and least-privilege access controls can limit the impact of a successful exploitation.
Long-term, organizations should establish robust software supply chain management practices, including regular dependency audits and vulnerability scanning. Given that FastJson 1.x is no longer actively maintained, organizations are strongly advised to replace it with a secure, supported alternative.
References
BleepingComputer: Hackers target US firms in FastJson RCE zero-day attacks https://www.bleepingcomputer.com/news/security/hackers-target-us-firms-in-fastjson-rce-zero-day-attacks/
Imperva: CVE-2026-16723 FastJson 1.x Zero-Day RCE https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/
FearsOff (Vulnerability discoverer) https://twitter.com/fearsoff
Alibaba FastJson GitHub Issues https://github.com/alibaba/fastjson/issues
ThreatBook: Fastjson RCE (≤1.2.83): Active Exploitation Detected https://threatbook.io/blog/fastjson-rce-1.2.83-active-exploitation-detected-detection-mitigation
Reddit: r/SecOpsDaily thread https://www.reddit.com/r/SecOpsDaily/comments/1v8hud8/hackers_target_us_firms_in_fastjson_rce_zeroday/
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our advanced analytics and threat intelligence capabilities empower security teams to proactively identify vulnerabilities, prioritize remediation, and ensure compliance with industry standards. For more information about how Rescana can help safeguard your organization, or if you have questions about this advisory, please contact us at info@rescana.com.
