FastJson Zero-Day Exploited in Attacks on US Firms

Active exploitation confirmed. Hackers are targeting U.S. organizations using an unpatched remote code execution vulnerability in FastJson, Alibaba’s open-source Java library for JSON processing. BleepingComputer reported the campaign on July 27.

No user interaction required. No elevated privileges required.

FastJson is one of the most widely deployed Java JSON libraries by download volume — embedded in enterprise applications, microservices, and middleware stacks across the industry. The library has a documented history of deserialization vulnerabilities, a recurring attack class in JSON processing code where maliciously crafted input triggers code execution on the server. A CVE ID for this specific zero-day has not been confirmed by NVD at time of writing — treat any circulating ID as unverified until NVD publishes.

Exploitation status: active, U.S. firms targeted. Attribution: unconfirmed. Patch: none published as of July 27.

Immediate actions:

• Audit all Java applications for FastJson as a direct or transitive dependency — check pom.xml, build.gradle, and dependency lock files. Transitive pulls are as exposed as direct ones.
• Any FastJson-backed service that accepts untrusted JSON input over the network is at elevated risk. Treat those endpoints as priority until a vendor patch is available.
• Monitor FastJson’s GitHub repository and Alibaba security channels — a patch will appear there first.
• Watch for anomalous child process activity from Java application servers — a common indicator of successful deserialization-based RCE.

This is not the only high-severity open-source RCE moving this week. n8n patched a sandbox escape for authenticated users on July 27; vBulletin’s pre-authentication RCE gained a public proof-of-concept the same day. If you haven’t audited open-source dependencies in your attack surface recently, the window for doing it quietly is closing.