Unpatched Fastjson Vulnerability Exploited in Attacks
The critical remote code execution bug can be exploited without authentication, under the library’s stock default configurations. The post Unpatched Fastjson Vulnerability Exploited in Attacks appeared first on SecurityWeek.
Threat actors have been exploiting a critical-severity remote code execution (RCE) vulnerability in Fastjson, security researchers warn.
A popular JSON processing library for Java, Fastjson was developed by Alibaba for JSON serialization and deserialization.
Tracked as CVE-2026-16723 (CVSS score of 9), the unauthenticated bug impacts all deployments running as a Spring Boot executable fat-jar, which is the most widely used deployment model.
Source: https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/
Related breach coverage
- PTC Windchill Vulnerability Exploited in Ransomware Campaign2026-07-27
The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication. The post PTC Windchill Vulnerability Exploited in Ransomware Campaign appeared first on SecurityWeek.
- Exploitation of ServiceNow Vulnerability Seen Days After Disclosure2026-07-21
The ServiceNow AI platform vulnerability tracked as CVE-2026-6875 can be exploited for remote code execution. The post Exploitation of ServiceNow Vulnerability Seen Days After Disclosure appeared first on SecurityWeek.
- Fresh SharePoint Vulnerability Exploited Soon After Disclosure2026-07-17
The critical-severity security defect allows remote, authenticated attackers to execute arbitrary code on the server. The post Fresh SharePoint Vulnerability Exploited Soon After Disclosure appeared first on SecurityWeek.
- 7 Severe Vulnerabilities Patched in VMware Avi Load Balancer2026-07-14
The flaws can be exploited for authentication bypass, remote code execution, privilege escalation, and directory traversal. The post 7 Severe Vulnerabilities Patched in VMware Avi Load Balancer appeared first on SecurityWeek.