$0 patch. That's the problem.
Per The Hacker News and BleepingComputer, attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java, tracked as CVE-2026-16723 with a CVSS score of 9.0. This vulnerability allows a malicious JSON request to execute code without authentication, with the privileges of the Java process, in affected Spring Boot applications, secondo Matrice Digitale.
While many view this as a vulnerability problem, it's actually a patch governance failure, as there's no patch available for Fastjson 1.x, confermato da The Hacker News. The SANS Internet Storm Center notes that related scans for Java Spring Boot "heapdump" endpoints can expose sensitive data, including API keys and database passwords, which can be used to further exploit the vulnerability.
The defensive math: -> Implement a web application firewall (WAF) to detect and prevent malicious JSON requests, as recommended by Imperva, cited in The Hacker News. -> Disable the "/actuator/heapdump" endpoint in Spring Boot applications to prevent sensitive data exposure, as suggested by the SANS Internet Storm Center. -> Conduct an emergency audit of all Java applications using Fastjson to identify and mitigate potential vulnerabilities, given the lack of a patch, as advised by BleepingComputer.
Can you assure your board that your Java applications are not exposed to this zero-day exploit?
https://tomodachi.work/zanshin/