[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqbnAjQBhD3D0a60q5kme3wjmKD3lUu5YzghAGeSDg_8":3},{"article":4,"iocs":51,"watch_terms":61,"solutions":62,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"6e2f2f21-c97a-4e76-bfe0-c3da6b4825e2","Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available","fastjson-1-x-rce-vulnerability-targeted-in-attacks-with-no-patched-available-8083b8","Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires","Attackers are actively exploiting a critical remote code execution vulnerability (CVE-2026-16723) in Alibaba's Fastjson 1.x library, affecting Spring Boot applications. The flaw allows unauthenticated code execution with the privileges of the Java process. As of July 25, 2026, no patched version of Fastjson 1.x is available, and organizations are advised to enable SafeMode or migrate to Fastjson2.","Fastjson 1.x RCE vulnerability (CVE-2026-16723) is being actively exploited.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Ffastjson-1x-rce-vulnerability-targeted.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjVdPXrvOB3xbf282jC7eawBsl-YwExczqZ471NiKOResjulD8TvOSelU5VGbgoHqVhNLaigBkE2N50AFtSqbOoXUQTtxgIHO05jYpTn5VyG4BPhlr1CbscCn4g8S3I4jdZ1_p67zSM91K25xq1X4-btuY3tFgVseyO-aLWlsdvZaNkwAhyphenhyphenafk4DH2l6Fs\u002Fs1600\u002Ffastjson.gif","2026-07-25T12:52:43+00:00","2026-07-25T14:00:08.661864+00:00",9,[17,20,23,25,28,31],{"name":18,"type":19},"Fastjson 1.x","product",{"name":21,"type":22},"Alibaba","vendor",{"name":24,"type":19},"Spring Boot",{"name":26,"type":27},"JSON","technology",{"name":29,"type":30},"ThreatBook","threat_actor",{"name":32,"type":30},"Imperva","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,41,46],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,59],{"type":53,"value":54,"context":55},"cve","CVE-2026-16723","Fastjson 1.x RCE vulnerability",{"type":45,"value":57,"context":58},"browser impersonators","Used in exploitation attempts",{"type":45,"value":60,"context":58},"Ruby and Go tools",[21,18,24],{"controls":63,"vendors":147},[64,93,118],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,102,110],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":94,"product_name":99,"url":100,"description":101},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":119,"name":120,"problem":121,"products":122},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[148],{"slug":149,"name":32,"logo_path":150,"roles":151},"imperva","\u002Fvendor-logos\u002Fimperva.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":166},"zero-patch-rce-in-fastjson-1x-demands-immediate-mitigation","Zero-Patch RCE in Fastjson 1.x Demands Immediate Mitigation","Attackers are actively exploiting CVE-2026-16723, a critical remote code execution flaw in Alibaba's Fastjson 1.x library, with no official patch currently available. The vulnerability allows unauthenticated attackers to execute arbitrary code with the full privileges of the underlying Java process, making it especially dangerous in internet-facing Spring Boot applications. This incident highlights the risk of depending on end-of-life or unmaintained open-source libraries in production environments. Organizations that lack a current software bill of materials (SBOM) are unable to quickly identify where Fastjson 1.x is used, significantly slowing their response time. When upstream vendors cannot deliver a timely patch, teams must rely on configuration-based mitigations and proactive migration strategies.",[158,159,160,161,162,163,164,165],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SA-22: Unsupported System Components","NIST SP 800-161: Supply Chain Risk Management","NIST CSF ID.AM-2: Software platforms and applications are inventoried","OWASP A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (risk-appropriate technical measures)",{}]