Loading story…
Alibaba disclosed a critical remote code execution flaw, tracked as CVE-2026-16723, in fastjson 1.x versions 1.2.68 through 1.2.83, including the final 1.x release. The vulnerability is exploitable under the library’s default configuration, does not require AutoType to be enabled, and does not depend on a classpath gadget chain. Alibaba said common parsing entry points such as JSON.parse and JSON.parseObject are affected, and that specifying a target DTO class does not reliably block exploitation because attacker-controlled payloads can be embedded in Object- or Map-typed fields.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Alibaba released Fastjson version 1.2.84 to address the remote code execution vulnerability CVE-2026-16723 affecting Fastjson 1.x. The release was presented alongside guidance to upgrade or use mitigations such as SafeMode or the 1.2.83_noneautotype build.
BleepingComputer reported that attackers exploiting CVE-2026-16723 were primarily targeting U.S.-based organizations in financial services, healthcare, computing, retail, and business, with some attacks also observed in Singapore and Canada. The report also noted there was still no patch available and that fastjson 1.x was reportedly no longer actively maintained.
ThreatBook and Imperva reported observing exploitation activity targeting CVE-2026-16723 in the wild. The reports did not provide proof of successful compromise or identify any victims, but they marked the flaw as being actively targeted.
The CVE entry for CVE-2026-16723 was received by Alibaba's CNA and documented the fastjson remote code execution issue affecting versions 1.2.68 through 1.2.83. The record assigned a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H and mapped the issue to CWE-20 and CWE-502.
FearsOff published research detailing how attacker-controlled @type input can trigger getResourceAsStream, enabling SSRF and, in certain Spring Boot fat-jar deployments, remote class loading leading to code execution. The write-up also described a two-step /proc/self/fd technique to restore RCE on modern JDKs such as JDK 21.
Alibaba published a critical security advisory for a remote code execution vulnerability affecting fastjson versions 1.2.68 through 1.2.83. The advisory said the flaw is exploitable under default configuration in Spring Boot fat-jar deployments and credited Kirill Firsov of FearsOff Cybersecurity with responsible disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
16 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcexakep.ru
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcethreatbook.io
Open sourcefearsoff.org
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical deserialization vulnerability in **Fastjson 1.2.x** allows unauthenticated remote code execution by abusing the library’s internal type-resolution logic, bypassing traditional `autoType` blacklist and whitelist protections without requiring third-party gadget classes on the target system. Public disclosure and proof-of-concept details identified affected versions as **1.2.68 through 1.2.83** when **SafeMode** is disabled, with researchers noting that **Spring Boot fat-jar** classloading can enable attacker-controlled remote class loading over HTTP. Analysis indicates the flaw is most likely to produce full RCE on **JDK 8**, while newer JDK versions may limit impact to **SSRF** in some environments.
Jul 25, 2026
Multiple critical vulnerabilities in **JSONata** allow attackers to achieve arbitrary code execution in server-side Node.js applications that evaluate untrusted JSONata expressions. The issues, tracked as `CVE-2026-77413`, `CVE-2026-77414`, and `CVE-2026-77415`, stem from prototype pollution, unsafe property lookups, and object-integrity weaknesses that let crafted expressions reach inherited prototype members, manipulate internal function and lambda state, and ultimately invoke `process.getBuiltinModule` and `child_process`. The flaws are remotely exploitable without authentication or user interaction and can expose environment variables, configuration files, and database credentials while enabling persistence and lateral movement. Project maintainers shipped a series of hardening changes across the `1.x` and `2.x` branches, including blocking `$lookup` access to prototype members, replacing vulnerable objects with `Object.create(null)`, using safer `Object.prototype.hasOwnProperty.call` checks, preventing traversal into function-like objects, and rejecting reserved internal identifiers such as `_jsonata_lambda` and `_jsonata_function`. Affected versions include releases before `1.8.8` and `2.x` versions prior to `2.2.1`, with fixes delivered through `1.8.8`/`1.8.9`, `2.2.0`, and `2.2.1`; organizations using JSONata to process user-supplied expressions should prioritize upgrading and review exposed services for possible exploitation.
Aug 22, 2026
A deserialization vulnerability tracked as **`CVE-2026-25747`** affects the Apache Camel LevelDB component and can lead to arbitrary code execution. Red Hat rated the issue **Important** with a **CVSS v3 score of 7.8**, stating the flaw stems from Camel-LevelDB using **`java.io.ObjectInputStream`** to read LevelDB aggregation repository data without validation or class-loading restrictions. If an attacker can write a malicious serialized Java object into the LevelDB database files, the application may deserialize it and execute attacker-controlled code. Red Hat said no acceptable mitigation is currently available under its product security criteria. In its product status matrix, **Red Hat build of Apache Camel for Spring Boot 4** and **Red Hat Fuse 7** are marked **Will not fix**, while **Red Hat JBoss Enterprise Application Platform 8** and the **JBoss Enterprise Application Platform Expansion Pack** are listed as **Not affected** because the vulnerable component is not present. The issue is cataloged in the CVE program as **`CVE-2026-25747`**.
Aug 20, 2026