Attackers are exploiting a critical Fastjson RCE vulnerability that can let an unauthenticated remote adversary run code on affected Java application servers, according to a July 28 report from SecurityWeek. The flaw, tracked as CVE-2026-16723, carries a CVSS 3.1 score of 9.0 from Alibaba and affects Fastjson 1.2.68 through 1.2.83.

Fastjson is an Alibaba-developed library used to serialize and deserialize JSON in Java applications. Alibaba lists improper input validation and deserialization of untrusted data as the underlying weakness classes. The vulnerable 1.x branch is no longer supported, while SecurityWeek reported that Fastjson 2.x is not affected.

Alibaba's advisory says the flaw is exploitable with the library's stock default configuration and does not require AutoType to be enabled or a classpath gadget. NIST's National Vulnerability Database records the attack vector as network-accessible, requiring no privileges or user interaction, although attack complexity is rated high.

SecurityWeek, citing Imperva, said crafted JSON containing a malicious @type value can trigger attacker-controlled resource lookups and reach a code-execution path. The report said the bypass abuses annotation-based type resolution to evade protections normally associated with disabling AutoType. Successful exploitation could compromise the confidentiality, integrity and availability of the server.

Imperva observed attacks against organizations in business, computing, financial services, healthcare and retail in the United States, with additional activity in Singapore and Canada, according to SecurityWeek. No official patch is available for the affected 1.x versions. The report did not identify victims or attribute the activity to a named threat actor.

Organizations should inventory applications and software dependencies for Fastjson 1.2.68 through 1.2.83 and prioritize exposed Spring Boot fat-jar deployments. Alibaba and the security firms recommend migrating to Fastjson 2.x; where migration cannot be completed immediately, defenders should enable SafeMode, restrict suspicious POST and JSON requests, monitor application traffic and isolate affected services while remediation is tested.