Unpatched Fastjson Vulnerability Exploited in Attacks

Threat actors are actively exploiting CVE-2026-16723, a critical unauthenticated remote code execution vulnerability in the widely used Fastjson 1.x Java library, which is particularly prevalent in Spring Boot applications. The flaw allows attackers to craft malicious JSON payloads that bypass default security configurations and execute arbitrary code without any authentication, making it extremely dangerous for internet-facing services. Because no patch exists for the affected 1.x branch, organizations that have not inventoried their dependencies or established upgrade pathways are left critically exposed. This incident underscores the risk of depending on unmaintained or end-of-life library versions in production environments without a clear remediation strategy.