Critical Fastjson Zero-Day CVE-2026-16723 Actively Exploited for Remote Code Execution on Java Servers
A critical zero-day vulnerability identified as CVE-2026-16723 is being actively exploited in Fastjson 1.x to achieve remote code execution on Java servers processing JSON data. The 1.x branch has no official patch, leaving mitigation options limited to enabling SafeMode, deploying a noneautotype build, or migrating to fastjson2.
The active exploitation of CVE-2026-16723 has placed significant pressure on security and development teams maintaining production Java services that rely on Fastjson 1.x. The flaw permits remote code execution without authentication, user interaction, or elevated privileges, making it especially dangerous for servers exposing JSON endpoints to the internet.
The issue affects Fastjson versions 1.2.68 through 1.2.83, including the final 1.2.83 release of the 1.x line. Exploitation works specifically when the application runs as a Spring Boot executable fat JAR launched with java -jar. Researchers have reproduced the attack on Spring Boot 2.x, 3.x, and 4.x across JDK 8, 11, 17, and 21.
The attack leverages deserialization and the @type mechanism. Even organizations that previously disabled AutoType remain vulnerable because the exploit functions under standard configurations with both AutoType and SafeMode turned off. The type resolution logic permits attacker-controlled resource lookups before restrictions are enforced.
Observed activity has focused primarily on organizations in the United States, with additional signals in Singapore and Canada. Impact spans financial services, healthcare, retail, and enterprise computing environments. A successful compromise can lead to full server control, credential theft, or deployment of additional malicious payloads.
Because no official update exists for Fastjson 1.x and a patch is considered unlikely, immediate mitigation requires enabling SafeMode via -Dfastjson.parser.safeMode=true, ParserConfig.getGlobalInstance().setSafeMode(true), or fastjson.properties. Where feasible, organizations should replace the dependency with com.alibaba:fastjson:1.2.83_noneautotype and plan migration to fastjson2, which uses a stricter allowlist design by default.
Related articles
GitLab Developer Account Leads to Full OpenStack Cloud Control via CI/CD Runner Misconfigurations
A penetration testing team demonstrated how a standard developer account in GitLab can be escalated to full administrative control over an OpenStack cloud environment through typical CI/CD misconfigurations. Starting with only GitLab credentials, the testers created a pipeline that executed arbitrary commands on a production Kubernetes runner named PROD-K8S-RUNNER01. Membership in the docker group allowed privilege escalation to root by mounting the host filesystem and adding an SSH key. From the compromised host, the team discovered a kubeconfig file granting extensive Kubernetes permissions including secret access, pod execution, and role bindings. This access enabled mounting a node filesystem to extract OpenStack cloud-config credentials. The resulting cloud account possessed broad roles across nova, cinder, neutron, and other services, effectively providing administrator-level control over virtual machines, networks, storage, and managed Kubernetes clusters.
Critical Vulnerability in JetBrains TeamCity Allows Unauthenticated Remote Code Execution
JetBrains has disclosed a critical vulnerability in its on-premises TeamCity CI/CD server that permits remote attackers to execute arbitrary operating system commands without authentication. The flaw, tracked as CVE-2026-63077, affects the agent polling protocol and can be exploited simply by accessing the TeamCity Server over HTTP or HTTPS. With a CVSSv3.1 base score of 9.8, the issue is rated Critical and could lead to data theft, configuration changes, or compromise of build artifacts and downstream pipelines. No in-the-wild exploitation had been observed at the time of disclosure. JetBrains has released fixed versions TeamCity 2026.1.3 and 2025.11.7, along with a patch plugin for all releases since 2017.1, and recommends restricting external access until updates can be applied.
Critical OS Command Injection Flaw in Arista VeloCloud Orchestrator Exploited in the Wild
Arista Networks has disclosed a critical vulnerability in the on-premises version of its VeloCloud Orchestrator product used for centralized SD-WAN management. The flaw, tracked as CVE-2026-16812, is an OS command injection issue that allows remote attackers to compromise the system without any authentication. Exploitation has already been confirmed, and the vulnerability carries the maximum CVSS base score of 10.0 in both version 4.0 and 3.1, classifying it as Critical. Successful attacks can impact the confidentiality, integrity, and availability of the orchestrator and all managed data. In addition, a compromised VeloCloud Orchestrator instance may grant attackers access to connected VeloCloud Edge devices across the network.
CISA Adds Exploited Flaws in FortiOS and VeloCloud Orchestrator to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-16812 affects the on-premises version of Arista VeloCloud Orchestrator and allows OS command injection that can lead to data leakage, tampering, and denial of service. The flaw carries a maximum CVSS v3.1 base score of 10.0 and is rated Critical. CVE-2025-68686 impacts Fortinet FortiOS and can be used to bypass specific patches and steal sensitive information when combined with another vulnerability that grants prior filesystem access. Federal agencies must remediate the VeloCloud issue by July 30 and the FortiOS issue by August 10.