# Unpatched Fastjson Vulnerability Exploited in Global Cyber Attacks

*Published July 29, 2026*
*Source: [https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/](https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/)*

## Executive Summary

A critical vulnerability in the Fastjson library is being exploited globally, allowing attackers to execute arbitrary code on vulnerable systems. Organizations should urgently migrate to Fastjson 2.x or apply recommended security configurations to mitigate risks.

## Article

Cybersecurity researchers have identified a critical remote code execution vulnerability in the Fastjson library, which is being actively exploited by threat actors. Fastjson, a widely used Java library for JSON processing developed by Alibaba, is vulnerable to exploitation in its versions 1.2.68 through 1.2.83. These versions are no longer supported, and the vulnerability is tracked as CVE-2026-16723 with a CVSS score of 9. The flaw allows remote attackers to execute arbitrary code on target servers running as Spring Boot executable fat-jars, posing significant risks to system confidentiality, integrity, and availability. The problem stems from Fastjson's default configuration, which does not require AutoType enablement or a classpath gadget to exploit. The vulnerability can be triggered through crafted JSON files containing malicious @type values that manipulate the library into executing code. Organizations across various sectors including business, healthcare, and finance have been targeted, particularly in the US, Singapore, and Canada. With no official patch available, experts recommend migrating to Fastjson version 2.x, enabling SafeMode, or blocking specific JSON requests to mitigate the risk. The lack of required authentication or user interaction makes this vulnerability a high-priority threat for affected systems.