Security researchers have confirmed active exploitation of a critical flaw in Fastjson, the Java library Alibaba built for converting data to and from JSON, that is bundled inside a huge number of backend business applications without most companies ever noticing it's there. The flaw, tracked as CVE-2026-16723 and rated 9.0 out of 10 in severity, lets an attacker send a single crafted JSON request to an affected Spring Boot application and run their own code on the server — no login, no malware download, no tricking an employee into clicking anything.
The vulnerability affects Fastjson versions 1.2.68 through 1.2.83 running inside Spring Boot "fat-JAR" deployments where SafeMode, an optional protection, has been left switched off — which is the default. Kirill Firsov of FearsOff Cybersecurity reported the flaw responsibly, and Alibaba published its advisory on 21 July. Threat intelligence firm ThreatBook says it caught exploitation happening in the wild before the advisory even went public, and Imperva has since documented attacks hitting financial services, healthcare, computing and retail companies, concentrated in the United States with smaller clusters in Singapore and Canada. As of this writing, Alibaba has not released a patched 1.x version of Fastjson — only a mitigation and a recommendation to migrate to its successor, Fastjson2.
What this means for your business
- This only matters if you run a custom Java or Spring Boot backend — an internal tool, an e-commerce platform, an admin panel, or anything a developer built for you rather than an off-the-shelf SaaS product. If your business runs entirely on hosted platforms with no custom backend code, this one passes you by.
- Ask whoever built or hosts your backend software one direct question: "does anything we run use Fastjson, and which version?" Fastjson is very often a dependency pulled in by something else, not a library a developer chose deliberately — it can be present without anyone remembering it's there.
- There is no patched version to simply update to. If Fastjson 1.2.68–1.2.83 turns up, the fix right now is enabling SafeMode (a configuration flag, not a code change) or migrating to Fastjson2 — treat this as an urgent configuration task this week, not something to wait on for "the next update."
- If you use a web application firewall or managed hosting provider, ask them directly whether they have added detection or blocking rules for CVE-2026-16723 exploitation attempts.
Flaws like this rarely make headlines the way a big-name breach does, because the affected component sits several layers beneath the software a business actually sees and uses. That is exactly why it is worth one direct question to your developer or hosting provider rather than assuming someone else already checked.