> TritonInfoSec News
Home / Jul 26, 2026 / Story
0
#1 The Hacker News general July 25, 2026 at 12:52 UTC

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

By [email protected] (The Hacker News)

AI Summary

CVE-2026-16723, a critical unauthenticated RCE vulnerability in Alibaba's Fastjson 1.x Java library (CVSS 9.0), is being actively exploited in the wild with no patch currently available. ThreatBook and Imperva confirmed that attackers can execute arbitrary code without authentication in affected Spring Boot applications by sending a malicious JSON request. Security practitioners running Spring Boot with Fastjson 1.x should treat this as an emergency given active exploitation and the absence of a vendor fix.

Read full article → https://thehackernews.com/2026/07/fastjson-1x-rce-…

Relevance score: 88.0/100

# More from July 26

  1. 2
    Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE The Hacker News
  2. 3
    Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git The Hacker News
  3. 4
    BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery The Hacker News
  4. 5
    Default Azure Automation Setting Enables Cross-Tenant Identity Takeover Dark Reading
  5. 6
    Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable The Hacker News
  6. 7
    Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts BleepingComputer
  7. 8
    Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks The Hacker News
  8. 9
    Golden Chickens Resurfaces With Four New Malware Families and Modular Implants The Hacker News
  9. 10
    Hermes AI agent used to automate attack on Thai Finance Ministry BleepingComputer