RCE-уязвимость в Fastjson используется в атаках

Hackers are actively exploiting a critical remote code execution (RCE) vulnerability in the popular Java library Fastjson, identified as CVE-2026-16723. This flaw allows unauthenticated attackers to execute arbitrary code remotely without user interaction. The issue affects Fastjson versions 1.2.68 through 1.2.83 when used in Spring Boot applications packaged as executable fat JARs. Attackers can exploit this by sending malicious JSON payloads that trigger class loading from external sources, bypassing standard AutoType restrictions. Alibaba has released version 1.2.84 to address the problem, and users are advised to update immediately or enable SafeMode as a temporary mitigation.