Critical Fastjson Zero-Day CVE-2026-16723 Actively Exploited for Remote Code Execution on Java Servers
A critical zero-day vulnerability identified as CVE-2026-16723 is being actively exploited in Fastjson 1.x to achieve remote code execution on Java servers processing JSON data. The 1.x branch has no official patch, leaving mitigation options limited to enabling SafeMode, deploying a noneautotype build, or migrating to fastjson2.
The active exploitation of CVE-2026-16723 has placed significant pressure on security and development teams maintaining production Java services that rely on Fastjson 1.x. The flaw permits remote code execution without authentication, user interaction, or elevated privileges, making it especially dangerous for servers exposing JSON endpoints to the internet.
The issue affects Fastjson versions 1.2.68 through 1.2.83, including the final 1.2.83 release of the 1.x line. Exploitation works specifically when the application runs as a Spring Boot executable fat JAR launched with java -jar. Researchers have reproduced the attack on Spring Boot 2.x, 3.x, and 4.x across JDK 8, 11, 17, and 21.
The attack leverages deserialization and the @type mechanism. Even organizations that previously disabled AutoType remain vulnerable because the exploit functions under standard configurations with both AutoType and SafeMode turned off. The type resolution logic permits attacker-controlled resource lookups before restrictions are enforced.
Observed activity has focused primarily on organizations in the United States, with additional signals in Singapore and Canada. Impact spans financial services, healthcare, retail, and enterprise computing environments. A successful compromise can lead to full server control, credential theft, or deployment of additional malicious payloads.
Because no official update exists for Fastjson 1.x and a patch is considered unlikely, immediate mitigation requires enabling SafeMode via -Dfastjson.parser.safeMode=true, ParserConfig.getGlobalInstance().setSafeMode(true), or fastjson.properties. Where feasible, organizations should replace the dependency with com.alibaba:fastjson:1.2.83_noneautotype and plan migration to fastjson2, which uses a stricter allowlist design by default.
Related articles
N-able Releases Hotfix for Exploited N-central Authentication Bypass Flaw CVE-2026-18577
N-able has published a hotfix addressing a high-severity authentication bypass vulnerability in its N-central IT operations management platform. The flaw, tracked as CVE-2026-18577, allows attackers to bypass authentication through alternative paths or channels and potentially take over user accounts. It affects N-central 2026.1 and earlier versions and stems from an incomplete fix for the earlier CVE-2026-18556 issue. The vulnerability carries a CVSS v4.0 base score of 8.2 and is rated High severity. Exploitation has already been observed in the wild, with Indicators of Compromise including related IP addresses now publicly available. N-able released N-central 2026.3 Hotfix 1 (build 2026.3.1.7) on August 2, 2026, and urges customers to apply the update while also recommending agent updates where possible.
Adobe Releases Emergency Update for Campaign Classic Fixing Multiple Critical Vulnerabilities
Adobe has issued an urgent security update for Adobe Campaign Classic to address seven critical vulnerabilities, including several with a maximum CVSSv3.1 base score of 10.0. The flaws affect on-premises deployments on Windows and Linux as well as the on-premises components of hybrid setups. Notably, the newly released fixes also impact the previous emergency update from July 29, version 7.4.3 build 9398, requiring users to apply the latest patch immediately. Among the most severe issues are a server-side request forgery vulnerability tracked as CVE-2026-48331, an input handling flaw in the template engine identified as CVE-2026-48323, and an SQL injection vulnerability labeled CVE-2026-48330. Adobe published the corresponding security advisory on August 3, 2026, urging rapid remediation despite the short interval since the prior update.
Dark Patterns in Vulnerability Management: How Metrics Undermine Real Security
Vulnerability management programs often fail not due to lack of scanners but because of poorly chosen metrics that prioritize reporting over actual risk reduction. Teams focus on closing easy vulnerabilities, meeting CVSS-based deadlines, and improving dashboard numbers while attackers exploit the shortest path to critical assets. The article examines five common traps including total vulnerability counts, context-free SLAs, closure rate targets, static dashboards, and claims of no critical findings. It argues that these metrics create a false sense of security and distort team behavior according to Goodhart's Law. Instead, organizations should adopt attack path metrics, exposure management approaches such as CTEM, and measurements that track real reduction in attacker reachability. The piece highlights MaxPatrol Carbon as an example of tools that model attacker paths rather than isolated CVEs.
MongoDB Server Patches 24 Vulnerabilities Including Critical Flaw in mongod Compute Mode
MongoDB has released updates addressing 24 vulnerabilities in MongoDB Server, with one rated critical. The patches cover multiple branches and include fixes for CVE-2026-13072, which carries a CVSSv3.1 base score of 9.2. The critical issue affects standalone mongod instances with compute mode enabled and stems from insufficient validation of external input that can lead to memory corruption. Additional fixes resolve 16 high-severity issues, seven medium, and one low, including CVE-2026-13059 that could allow unauthorized read-write actions by low-privileged authenticated users. Updated versions MongoDB 8.3.7, 8.2.12, 8.0.28, and 7.0.39 are now available. The company published the updates on July 22, 2026, and urges immediate application to maintain system integrity.