Attackers are actively exploiting CVE-2026-16723, a remote code execution vulnerability in FastJson, the popular open-source Java library built by Alibaba for converting Java objects to and from JSON. The flaw affects FastJson versions 1.2.68 through 1.2.83 and requires no authentication and no user interaction — the only condition is that the target application runs as a Spring Boot fat-JAR (launched via java -jar). Alibaba has rated it critical severity and confirmed it is exploitable against “the most common Spring Boot deployment model.” Attackers abuse the library’s type-resolution logic to perform attacker-controlled resource lookups before AutoType restrictions are enforced, loading and executing malicious classes without needing a third-party gadget chain.
Security researchers at ThreatBook first spotted active exploitation last week; Imperva subsequently confirmed attacks spanning financial services, healthcare, computing, retail, and other sectors — with targeting currently concentrated in US-based organisations, and some activity reaching Singapore and Canada. There is no patch for FastJson 1.x, which is no longer actively maintained. Alibaba advises developers to immediately enable SafeMode in their FastJson configuration or migrate to fastjson2, the successor library, which uses an allowlist model for polymorphic deserialization and is not affected by this flaw.
How to check if you’re affected
Affected versions are FastJson 1.2.68 through 1.2.83 used in Spring Boot fat-JAR deployments. Versions 1.2.60 and earlier are not vulnerable, and non-fat-JAR deployments are also unaffected. Applications that have already migrated to fastjson2 are not affected. If you maintain a Java service using FastJson 1.x, check your pom.xml or build.gradle for the dependency version; if it falls within the affected range and the service runs as a Spring Boot executable JAR, treat it as compromised until SafeMode is enabled or migration to fastjson2 is complete.