Act
archived
Fastjson 1.x RCE (CVE-2026-16723) Actively Exploited, No Patch
- Engineer — Act: Fastjson 1.x is embedded in many Spring Boot applications; unauthenticated RCE with a public PoC and confirmed active attacks means immediate action is required — audit all services for Fastjson 1.x dependencies, apply WAF rules to block the malicious JSON chain, and isolate or rate-limit exposed endpoints until a patch is available.
- SOC/IR — Act: Multi-source confirmation of active exploitation gives a detection mandate now — hunt for anomalous JSON deserialization patterns in HTTP request logs to Spring Boot services and monitor for unexpected outbound connections or process spawning from Java app servers since the earliest confirmed attack date.
- Leader — Plan: A critical, unpatched RCE in a widely-used Java library under active attack warrants commissioning an urgent Fastjson 1.x exposure inventory across development teams this week; if use is confirmed, allocate engineering time for compensating controls and track remediation until a vendor patch is released.
- Signals: CVE-2026-16723 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.