Fastjson RCE Flaw: What NJ Businesses Should Do Now

There's a Critical Java Vulnerability Being Actively Exploited Right Now

If your business runs any web application built on Java, specifically anything using Spring Boot, you need to know about CVE-2026-16723. Security researchers have confirmed attackers are actively targeting a flaw in Fastjson, a widely used JSON parsing library made by Alibaba. The CVSS score is 9.0 out of 10. That's not a theoretical risk sitting in a researcher's lab. It's being used in real attacks right now.

Here's the part that should get your attention. An attacker can send a specially crafted JSON request to a vulnerable application and execute code on your server without ever logging in. They run that code with whatever permissions your Java process has. If that process has admin or root access, so does the attacker.

What Makes This Harder Than a Typical Patch Tuesday Problem

Most vulnerabilities get fixed with a patch. You update, you're done. This one is different. As of right now, there is no official patch available for Fastjson 1.x. The vendor hasn't released a fix yet. That means the standard advice, keep your software updated, doesn't fully apply here. You can't just click update and move on.

That puts businesses in an uncomfortable spot. The vulnerability is known. Attackers are already using it. And the fix isn't ready yet.

For small and mid-size businesses in NJ and NYC, this matters more than it might seem. A lot of line-of-business applications, customer portals, internal tools, and third-party software packages use Java under the hood. Many business owners have no idea their vendor is using Fastjson. That's not a criticism, it's just how software works. Libraries get bundled inside other products and most people never see them.

How to Find Out If You're Exposed

Start by asking your software vendors a direct question: does your application use Fastjson 1.x? Any vendor worth working with should be able to answer that quickly. If they can't, that's a signal about how seriously they take security.

If you manage your own Java applications or have a development team, check your dependency files. In Maven projects that's your pom.xml. In Gradle it's build.gradle. Search for com.alibaba:fastjson and look at the version number. Version 1.x means you're potentially vulnerable.

Your IT team or MSP should also be scanning for this using a software composition analysis tool or a vulnerability scanner that covers application dependencies, not just operating system patches. Tools like Tenable or Qualys can surface this kind of exposure if they're configured properly.

What You Can Do While Waiting for a Patch

Since patching isn't an option yet, the focus shifts to reducing exposure. A few things that actually help right now.

First, limit network access to any Java-based applications that don't need to be publicly reachable. If an internal tool is sitting exposed to the internet for convenience, pull it back behind a VPN or firewall rule. That alone cuts a lot of attack surface.

Second, look at your web application firewall rules. If you're using a WAF in front of any Java applications, make sure it's inspecting JSON payloads and blocking known exploit patterns for this CVE. Imperva has already flagged active attack traffic, so WAF vendors are updating their signatures.

Third, review the permissions your Java processes run with. If a process is running as a local admin or a domain account with broad access, that makes a successful exploit far more damaging. Least privilege isn't exciting advice, but it limits the blast radius when something goes wrong.

Fourth, watch your logs. Look for unusual outbound connections from your application servers, unexpected process spawning, or anything hitting your Java application endpoints with malformed or oversized JSON requests.

The Bigger Point for Business Owners

Most small businesses have no visibility into what software libraries are running inside their applications. That's a real gap. When a vulnerability like this surfaces with no patch available, businesses that have already done the inventory work are in a much better position. They know what they're running, they know who to call, and they can act in hours instead of days.

If you're not sure what Java applications are running in your environment or who's responsible for monitoring them, that's worth sorting out before the next one of these comes along. Exine works with NJ and NYC businesses on exactly this kind of security visibility and response planning.