CVE-2026-16723: FastJson 1.x Zero-Day RCE Actively Exploited Against U.S. Financial, Healthcare, and Retail Sectors — No Patch Available for End-of-Life Branch

A critical unauthenticated RCE vulnerability (CVSS 9.0) in Alibaba's FastJson 1.x library (versions 1.2.68–1.2.83) is being actively exploited against U.S.-based organizations across financial services, healthcare, and retail, with secondary activity in Singapore and Canada. Exploitation requires no credentials, no AutoType enablement, and no third-party gadget classes — only a Spring Boot fat-JAR deployment running the affected library. Because FastJson 1.x is end-of-life, no vendor patch exists; the only durable fix is migration to FastJson 2.x, which is unaffected.

Exploitation requires no credentials, no AutoType enablement, and no third-party gadget classes — only a Spring Boot fat-JAR deployment running the affected library.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.