With attackers actively exploiting the unpatched Fastjson vulnerability, I wanted to share a few expert perspectives in case you’re working on any coverage or looking at the broader implications beyond the immediate patching guidance.
If you are not up to speed with this vulnerability, this will help: Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Edwin Shuttleworth, Lead Penetration Tester & Security Researcher, Finite State (https://www.linkedin.com/in/edwincyber)
“This vulnerability is reminiscent of the Log4j remote-code-execution vulnerability disclosed in 2021, in which a critical flaw in a widely used subcomponent left defenders asking not only how to patch, but what to patch. Fastjson is deployed across an enormous range of products. I have encountered it in everything from Android applications to embedded devices such as security cameras, yet many organizations have little insight into where it exists within their environments.
“The broader problem is that most organizations still lack a reliable connection between their asset inventories, the software components running on those assets, and the ways those components are exposed or used. High-quality Software Bills of Materials, or SBOMs, are an important part of solving this problem. They should identify not only the software included in a product, but also its transitive dependencies: the dependencies of those components, the dependencies of those dependencies, and so on. When a vulnerability is discovered deep in the software supply chain, defenders should be able to query a centralized inventory and quickly identify every potentially affected product and service.”
Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)
“Fastjson is a reminder that a CVSS score tells you how dangerous a vulnerability is in theory, but it can’t tell you if it’s exploitable or even reachable in your live environment. A critical RCE vulnerability buried behind three layers of network segmentation and non-privileged service accounts is a different exposure than the same CVE running on an internet-facing API with access to your data plane.
“The best advice I can give fellow practitioners is to build a repeatable way to answer the exploitability and reachability questions before the next zero-day forces you to.”
John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)
“One of the biggest mistakes people can make with this vulnerability is assuming it’s only a Chinese ecosystem problem because Fastjson was developed by Alibaba and has been widely used in Android applications and cloud services. That’s simply not true. Fastjson has found its way into enterprise software used around the world, including products like Oracle Communications Cloud Native Core. The real concern is that this is a software component, not a standalone product. Organizations often don’t realize they’re using it because it’s buried several layers down in their software stack. That means many security teams won’t know they’re exposed until someone else finds the vulnerability for them, and by then they’re already behind.”
Noelle Murata, Chief Operating Officer, Xcape (https://www.linkedin.com/in/nmurata)
“Unpatched open source components like Fastjson expose enterprises to remote code execution attacks because organizations lack real time visibility into their underlying application dependency trees. The fact that the technology industry is still getting systematically compromised by untrusted Java deserialization bugs in 2026 feels like a collective refusal to learn basic software engineering history. When a widely used library allows untrusted JSON payloads to execute arbitrary code under stock default configurations, it proves that application teams are still treating external inputs as inherently safe. Beyond emergency patching and enforcing SafeMode, security leaders must implement dynamic Software Bill of Materials tracking, restrict outbound network egress from application servers, and treat object deserialization as an inherently hostile operation across all development pipelines.
“Organizations should deploy continuous Software Bill of Materials tooling to discover transitive Fastjson 1.x components embedded inside application archives, enable SafeMode or migrate to Fastjson 2.x immediately to block untrusted object instantiation across all production endpoints, and isolate application servers with strict egress firewalls to prevent compromised parsers from downloading secondary payload tools.
“We have known that untrusted deserialization leads directly to system compromise for over a decade, yet here we are acting surprised when unpacking JSON turns into remote code execution.”
Any sort of vulnerability is dangerous. An unpatched one is even more dangerous as the bad guys take advantage of them and pwn you without a doubt.
Related
This entry was posted on July 29, 2026 at 8:13 am and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Fastjson attacks expose software supply chain blind spots
With attackers actively exploiting the unpatched Fastjson vulnerability, I wanted to share a few expert perspectives in case you’re working on any coverage or looking at the broader implications beyond the immediate patching guidance.
If you are not up to speed with this vulnerability, this will help: Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Edwin Shuttleworth, Lead Penetration Tester & Security Researcher, Finite State (https://www.linkedin.com/in/edwincyber)
“This vulnerability is reminiscent of the Log4j remote-code-execution vulnerability disclosed in 2021, in which a critical flaw in a widely used subcomponent left defenders asking not only how to patch, but what to patch. Fastjson is deployed across an enormous range of products. I have encountered it in everything from Android applications to embedded devices such as security cameras, yet many organizations have little insight into where it exists within their environments.
“The broader problem is that most organizations still lack a reliable connection between their asset inventories, the software components running on those assets, and the ways those components are exposed or used. High-quality Software Bills of Materials, or SBOMs, are an important part of solving this problem. They should identify not only the software included in a product, but also its transitive dependencies: the dependencies of those components, the dependencies of those dependencies, and so on. When a vulnerability is discovered deep in the software supply chain, defenders should be able to query a centralized inventory and quickly identify every potentially affected product and service.”
Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)
“Fastjson is a reminder that a CVSS score tells you how dangerous a vulnerability is in theory, but it can’t tell you if it’s exploitable or even reachable in your live environment. A critical RCE vulnerability buried behind three layers of network segmentation and non-privileged service accounts is a different exposure than the same CVE running on an internet-facing API with access to your data plane.
“The best advice I can give fellow practitioners is to build a repeatable way to answer the exploitability and reachability questions before the next zero-day forces you to.”
John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)
“One of the biggest mistakes people can make with this vulnerability is assuming it’s only a Chinese ecosystem problem because Fastjson was developed by Alibaba and has been widely used in Android applications and cloud services. That’s simply not true. Fastjson has found its way into enterprise software used around the world, including products like Oracle Communications Cloud Native Core. The real concern is that this is a software component, not a standalone product. Organizations often don’t realize they’re using it because it’s buried several layers down in their software stack. That means many security teams won’t know they’re exposed until someone else finds the vulnerability for them, and by then they’re already behind.”
Noelle Murata, Chief Operating Officer, Xcape (https://www.linkedin.com/in/nmurata)
“Unpatched open source components like Fastjson expose enterprises to remote code execution attacks because organizations lack real time visibility into their underlying application dependency trees. The fact that the technology industry is still getting systematically compromised by untrusted Java deserialization bugs in 2026 feels like a collective refusal to learn basic software engineering history. When a widely used library allows untrusted JSON payloads to execute arbitrary code under stock default configurations, it proves that application teams are still treating external inputs as inherently safe. Beyond emergency patching and enforcing SafeMode, security leaders must implement dynamic Software Bill of Materials tracking, restrict outbound network egress from application servers, and treat object deserialization as an inherently hostile operation across all development pipelines.
“Organizations should deploy continuous Software Bill of Materials tooling to discover transitive Fastjson 1.x components embedded inside application archives, enable SafeMode or migrate to Fastjson 2.x immediately to block untrusted object instantiation across all production endpoints, and isolate application servers with strict egress firewalls to prevent compromised parsers from downloading secondary payload tools.
“We have known that untrusted deserialization leads directly to system compromise for over a decade, yet here we are acting surprised when unpacking JSON turns into remote code execution.”
Any sort of vulnerability is dangerous. An unpatched one is even more dangerous as the bad guys take advantage of them and pwn you without a doubt.
Share this:
Like this:
Related
This entry was posted on July 29, 2026 at 8:13 am and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.