Loading story…
A critical deserialization vulnerability in Fastjson 1.2.x allows unauthenticated remote code execution by abusing the library’s internal type-resolution logic, bypassing traditional autoType blacklist and whitelist protections without requiring third-party gadget classes on the target system. Public disclosure and proof-of-concept details identified affected versions as 1.2.68 through 1.2.83 when SafeMode is disabled, with researchers noting that Spring Boot fat-jar classloading can enable attacker-controlled remote class loading over HTTP. Analysis indicates the flaw is most likely to produce full RCE on JDK 8, while newer JDK versions may limit impact to SSRF in some environments.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Imperva reported active exploitation of CVE-2026-16723 against organizations in financial services, healthcare, computing, and retail. The activity was said to be concentrated primarily in the United States, with additional targeting observed in Singapore and Canada.
Public technical details and working proof-of-concept code were released for the fastjson vulnerability, increasing urgency for defenders. Reporting noted likely full RCE on JDK 8, possible reduced impact on newer JDKs, and that exploitation requires outbound HTTP access from the target server.
NSFOCUS reported that exploitation of the fastjson 1.2.x remote code execution vulnerability had already been observed in the wild. Its notice also stated that no official fastjson 1.x security update was available and advised migration to fastjson 2.x or enabling SafeMode as mitigation.
Researcher Kirill Firsov publicly disclosed a remote code execution vulnerability in fastjson on July 19, 2026. The issue affects fastjson 1.2.68 through 1.2.83 when SafeMode is disabled and can bypass typical defenses without requiring a gadget class on the target classpath.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceimperva.com
Open sourcesecurityonline.info
Open sourcensfocusglobal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Alibaba disclosed a critical remote code execution flaw, tracked as **`CVE-2026-16723`**, in **fastjson 1.x** versions **`1.2.68` through `1.2.83`**, including the final 1.x release. The vulnerability is exploitable under the library’s default configuration, does **not** require AutoType to be enabled, and does **not** depend on a classpath gadget chain. Alibaba said common parsing entry points such as `JSON.parse` and `JSON.parseObject` are affected, and that specifying a target DTO class does not reliably block exploitation because attacker-controlled payloads can be embedded in `Object`- or `Map`-typed fields.
Aug 15, 2026
Jackson applications that deserialize attacker-controlled JSON with insecure polymorphic type handling can be coerced into instantiating dangerous classes. Research tracked as **CVE-2019-12384** showed that `ch.qos.logback.core.db.DriverManagerConnectionSource` can be used as a gadget to initiate attacker-selected JDBC connections, creating server-side request forgery (SSRF) and denial-of-service exposure. Where the H2 JDBC driver is available, a crafted JDBC URL using H2's `INIT=RUNSCRIPT` capability can load a remote SQL script and escalate the condition to remote code execution. Jackson's historic reliance on a denylist of known gadget classes means newly identified gadgets may remain exploitable until blocked; organizations should avoid unsafe polymorphic/default typing for untrusted input, update Jackson and dependent Java libraries, and review applications for exposed deserialization endpoints.
Aug 28, 2026
Multiple critical vulnerabilities in **JSONata** allow attackers to achieve arbitrary code execution in server-side Node.js applications that evaluate untrusted JSONata expressions. The issues, tracked as `CVE-2026-77413`, `CVE-2026-77414`, and `CVE-2026-77415`, stem from prototype pollution, unsafe property lookups, and object-integrity weaknesses that let crafted expressions reach inherited prototype members, manipulate internal function and lambda state, and ultimately invoke `process.getBuiltinModule` and `child_process`. The flaws are remotely exploitable without authentication or user interaction and can expose environment variables, configuration files, and database credentials while enabling persistence and lateral movement. Project maintainers shipped a series of hardening changes across the `1.x` and `2.x` branches, including blocking `$lookup` access to prototype members, replacing vulnerable objects with `Object.create(null)`, using safer `Object.prototype.hasOwnProperty.call` checks, preventing traversal into function-like objects, and rejecting reserved internal identifiers such as `_jsonata_lambda` and `_jsonata_function`. Affected versions include releases before `1.8.8` and `2.x` versions prior to `2.2.1`, with fixes delivered through `1.8.8`/`1.8.9`, `2.2.0`, and `2.2.1`; organizations using JSONata to process user-supplied expressions should prioritize upgrading and review exposed services for possible exploitation.
Aug 22, 2026