Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patch Available

**CVE-2026-16723 — Fastjson 1.x RCE in the wild:** A critical, unpatched remote-code-execution flaw in Fastjson 1.2.68–1.2.83 (Spring Boot fat-JAR) enables attacker-controlled bytecode loading via nested jar:// URLs; exploitation was confirmed by ThreatBook and Imperva beginning 2026-07-22, affects major JDKs, bypasses AutoType protections and deserialization blacklists, and has no patch as of 2026-07-26 — organizations should apply SafeMode, WAF/egress controls, audit dependencies, and migrate to Fastjson 2.x immediately.