[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP0fMPDvrUglYAuVLRe2jDDnI9BDnm2K_B78PLRWpv-o":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"297aefad-94fb-4278-9168-0a56190e2978","Unpatched Fastjson Vulnerability Exploited in Attacks","unpatched-fastjson-vulnerability-exploited-in-attacks-048818","The critical remote code execution bug can be exploited without authentication, under the library’s stock default configurations. The post Unpatched Fastjson Vulnerability Exploited in Attacks appeared first on SecurityWeek.","Threat actors are actively exploiting a critical RCE vulnerability (CVE-2026-16723) in the Fastjson Java library, particularly affecting Spring Boot deployments. The unauthenticated flaw allows attackers to execute arbitrary code by manipulating crafted JSON files, bypassing default security configurations. Organizations are urged to migrate to Fastjson 2.x or implement mitigation strategies as no patch is available for affected 1.x versions.","Fastjson vulnerability CVE-2026-16723 exploited for RCE without authentication.","https:\u002F\u002Fwww.securityweek.com\u002Funpatched-fastjson-vulnerability-exploited-in-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002Fcoding-vulnerability-software-development.jpeg","2026-07-28T07:27:55+00:00","2026-07-28T08:00:15.933979+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Fastjson","product",{"name":21,"type":22},"Alibaba","vendor",{"name":24,"type":25},"Java","technology",{"name":27,"type":25},"Spring Boot",{"name":29,"type":30},"threat actors","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-16723","Critical RCE vulnerability in Fastjson",[21,18],{"controls":61,"vendors":149},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":121,"name":122,"problem":123,"products":124},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",[150],{"slug":151,"name":152,"logo_path":153,"roles":154},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png",[155],"reported_by",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":172},"unpatched-fastjson-rce-flaw-actively-exploited-in-the-wild","Unpatched Fastjson RCE Flaw Actively Exploited in the Wild","Threat actors are actively exploiting CVE-2026-16723, a critical unauthenticated remote code execution vulnerability in the widely used Fastjson 1.x Java library, which is particularly prevalent in Spring Boot applications. The flaw allows attackers to craft malicious JSON payloads that bypass default security configurations and execute arbitrary code without any authentication, making it extremely dangerous for internet-facing services. Because no patch exists for the affected 1.x branch, organizations that have not inventoried their dependencies or established upgrade pathways are left critically exposed. This incident underscores the risk of depending on unmaintained or end-of-life library versions in production environments without a clear remediation strategy.",[161,162,163,164,165,166,167,168,169,170,171],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 SI-10 (Information Input Validation)","NIST SP 800-161 (Supply Chain Risk Management)","NIST CSF ID.AM-2 (Software Inventory)","NIST CSF RS.MI-3 (Vulnerability Mitigation)","OWASP A06:2021 – Vulnerable and Outdated Components","OWASP A08:2021 – Software and Data Integrity Failures","ITIL Change Management – Emergency Change Procedures","GDPR Article 32 – Security of Processing (where personal data is at risk)",{}]