Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-07-25 12:52 UTC
  • Importiert: 2026-07-31 13:46 UTC
  • CVSS: 9.0
  • Quelle-ID: thn_global
  • uid_hash: ba80bd470099db53fe813cf0cb0adc8933655662317449d616d6f2607b6d35fb
The Hacker News

Inhalt

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.

Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2026-16723

CRITICAL

9

CRITICAL

9

2026-07-23

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
The Hacker News

thn_global

 security_news - de https://feeds.feedburner.com/TheHackersNews
Zurueck zur Eintrags-Liste