FastJson RCE zero-day actively exploited against US firms

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Act: FastJson is widely used in Java applications; if your codebase or dependencies include it, audit immediately and apply any available patch or mitigations — if no patch exists, consider disabling unsafe deserialization features or replacing the library.
SOC/IR — Act: Active exploitation is underway against US firms; hunt for anomalous outbound connections or process spawning from Java application servers since this week, and tune detections for RCE post-exploitation behavior (e.g., web shells, unexpected child processes).
Leader — Plan: Active zero-day targeting US organizations warrants asking your engineering team this week whether FastJson is in use and what the mitigation timeline is — this may generate customer questions if it widens.

Fastjson 1.x RCE (CVE-2026-16723) Actively Exploited, No Patch

Sun, 26 Jul 2026 12:14:17 +0000

Engineer — Act: Fastjson 1.x is embedded in many Spring Boot applications; unauthenticated RCE with a public PoC and confirmed active attacks means immediate action is required — audit all services for Fastjson 1.x dependencies, apply WAF rules to block the malicious JSON chain, and isolate or rate-limit exposed endpoints until a patch is available.
SOC/IR — Act: Multi-source confirmation of active exploitation gives a detection mandate now — hunt for anomalous JSON deserialization patterns in HTTP request logs to Spring Boot services and monitor for unexpected outbound connections or process spawning from Java app servers since the earliest confirmed attack date.
Leader — Plan: A critical, unpatched RCE in a widely-used Java library under active attack warrants commissioning an urgent Fastjson 1.x exposure inventory across development teams this week; if use is confirmed, allocate engineering time for compensating controls and track remediation until a vendor patch is released.
Signals: CVE-2026-16723 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub