SECURITYJul 25 · 12:52 UTCTHE HACKER NEWS[email protected] (The Hacker News)

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Security firms ThreatBook and Imperva report attackers exploiting a critical Fastjson 1.x vulnerability (CVE-2026-16723) in Spring Boot applications, enabling unauthenticated code execution with Java process privileges. Alibaba's CVSS score of 9.0 highlights the severity, but no patch is currently available.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

ThreatBookorganizationImpervaorganizationFastjsontopicCVE-2026-16723topicSpring BoottopicCVSStopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYApr 7 · 17:02 UTC
Max severity Flowise RCE vulnerability now exploited in attacks
SECURITYApr 28 · 16:15 UTC
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
SECURITYMar 30 · 18:24 UTC
F5 BIG-IP Vulnerability Reclassified as RCE, Under Exploitation
SECURITYMay 7 · 13:34 UTC
PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage
SECURITYJun 30 · 11:18 UTC
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
SECURITYMay 17 · 11:57 UTC
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE