FastJson Zero-Day RCE: Active Exploitation Hits US Firms

Active exploitation confirmed. An unpatched remote code execution vulnerability in FastJson — Alibaba’s widely-deployed open-source Java parsing library — is being actively exploited against US organizations. BleepingComputer confirmed the attacks on July 27.

Status as of publication: Zero-day. No CVE assigned. No vendor patch available. Confidence: active exploitation — confirmed (BleepingComputer). Full technical root cause — unconfirmed; treat upstream claims with appropriate skepticism until an official advisory ships.

FastJson handles JSON serialization and deserialization in Java applications. It’s embedded as a dependency across enterprise Java stacks, microservices, and commercial frameworks — often several layers deep, not always visible in a first-pass dependency scan.

What’s known: The flaw allows remote code execution without user interaction or elevated privileges. That’s the worst exposure class for any networked service.

Historical context: FastJson has been a recurring attack surface. Deserialization vulnerabilities in the library — particularly abuse of its auto-type feature — were widely exploited between 2017 and 2022 and drew sustained attacker attention across that window. A new zero-day in this codebase should be treated as high-confidence serious, not speculative.

Immediate steps

• Find every FastJson instance: mvn dependency:tree | grep fastjson or gradle dependencies | grep fastjson across your repos. Transitive dependencies matter here — you may be pulling it in through a framework, not your own code.
• Prioritize internet-facing surfaces: Applications that parse untrusted JSON input through FastJson are the immediate risk. Assess them first.
• Watch for the patch: Monitor the FastJson GitHub repository and Alibaba security notifications. Set a NVD/CISA alert for when a CVE is assigned — that’s the signal a vendor advisory and KEV candidacy are imminent.
• Temporary mitigations: If you can front FastJson input parsing with strict schema validation and input size limits without breaking functionality, apply that now. Reducing the attack surface before the patch ships is worth the operational cost.

Priority call: RCE without user interaction or elevated privileges in a library embedded across the Java ecosystem is systemic risk, not a single-service problem. If your organization runs Java applications that accept external input and you haven’t audited FastJson presence, that audit is today’s priority.

Other critical RCE disclosures active this week: JetBrains TeamCity CVE-2026-63077 is patched and should be applied regardless of this one. Two separate exposure classes — don’t let one crowd out the other.

Source: BleepingComputer.