Hackers are actively leveraging a severe vulnerability in the **FastJson** open-source Java library, enabling remote code execution (RCE) without requiring user interaction or elevated privileges. This zero-day exploit impacts **FastJson** versions 1.2.68 through 1.2.83 and has been observed in attacks primarily targeting organizations within the U.S. ### Widespread Exploitation Detected The malicious activity was initially detected by agentic security company **ThreatBook** last week. Researchers at business protection company **Imperva** have since confirmed the widespread nature of these attacks, noting they are "targeting a wide range of organizations, across Financial Services, Healthcare, Computing, Retail, Business, and other industries." "Attacks are currently almost entirely targeting US-based organizations, with a few attacks in Singapore and Canada, although this will likely continue to expand globally," **Imperva** stated.  **FastJson**, developed by **Alibaba**, is a popular open-source Java library used for serializing and deserializing Java objects to and from JSON. With over 25,600 stars and 6,400 forks on GitHub, it is particularly prevalent in Chinese enterprise software and projects built on **Alibaba**'s platform. ### Understanding the Vulnerability: CVE-2026-16723 The vulnerability, identified as **CVE-2026-16723**, was discovered by offensive security company **FearsOff**, which published a technical write-up earlier this month. **FearsOff** researchers explained that the flaw originates from the library’s type-resolution logic. This logic performs attacker-controlled resource lookups before enforcing **AutoType** restrictions, creating a pathway for remote code execution, especially in **Spring Boot** fat-JAR deployments. By abusing `@type` processing, attackers can load and execute malicious classes even without **AutoType** enabled or requiring third-party gadget chains. ### No Official Fix Available **Alibaba** confirmed the critical severity of **CVE-2026-16723** in its security bulletin, warning that it is exploitable on "the most common **Spring Boot** deployment model." The vendor noted that the only deployment prerequisite is that the target runs as a **Spring Boot** executable fat-JAR (i.e., launched via `java -jar xxx.jar`). Crucially, specifying a target class during deserialization does not mitigate **CVE-2026-16723**, as attackers can embed malicious payloads within `Object` or `Map` fields. The vulnerable type-resolution logic is absent in **fastjson2**, which employs an allowlist-first model for polymorphic deserialization and does not rely on the `@JSONType` annotation as a trust signal. Additionally, **FastJson** versions 1.2.60 and earlier, as well as any non-fat-JAR deployments, are not affected. Currently, there is no official fix issued for **CVE-2026-16723**. **Imperva** has highlighted that **FastJson 1.x** is no longer actively maintained, making a security update for this branch highly unlikely. Developers using an affected version are strongly urged to immediately enable **SafeMode** or migrate to a non-impacted build.