CRITICALVulnerability
Global

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

·Source: The Hacker News

Updated:

Executive Summary

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires

Analysis

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires

Indicators of Compromise (1)

CVE (1)
CVE-2026-16723
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Jul 25, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Orion integrates co-developed account opening tool with Goldman Sachs

Orion announced today the launch of its Dynamic New Account Opening tool to support digital account opening within the Orion Advisor Portal.

Finextra
MEDIUMVulnerabilityNEW

The Sub-10-Minute Cloud Takeover: How Exposed IAM Keys, Misconfiguration and AI Are Rewriting the Rules of Cloud Breaches

Key Takeaways Two real-world cloud attacks reached meaningful impact in less than ten minutes despite pursuing entirely different objectives. Both attackers treated the environment as a connected system, using existing permissions and relationships to expand their reach. Reconnaissance increasingly focuses on understanding access and capability rather than discovering vulnerable assets. AI is comp

Qualys Blog
CRITICALVulnerability

GAO Report Identifies Potentially Duplicative Cyber Reporting Requirements for Critical Infrastructure

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is shortly due to issue a final rule implementing the Cyber Incident […] The post GAO Report Identifies Potentially Duplicative Cyber Reporting Requirements for Critical Infrastructure appeared first on The HIPAA Journal .

HIPAA Journal