FastJson Zero-Day CVE-2026-16723 and Your Dental Practice's

A translucent blue application container filled with dozens of small interlocking component bricks, one buried brick cracked and glowing red-orange with an intrusion thread reaching it, illustrating a dangerous flaw hidden in a bundled open-source component inside a larger trusted product

September 21, 2026 A Zero-Day Is Hitting Healthcare in Software Nobody Names: The FastJson Flaw (CVE-2026-16723) and Why You Can’t Protect Code You Don’t Know You Run

Posted at 05:39h in IT Security by Raymond

Some security alerts name a product you recognize – Windows, a firewall, a backup tool – and you can quickly decide whether it is yours to worry about. This week’s is the uncomfortable other kind. Security firms are tracking active, ongoing attacks against a flaw in a piece of software called FastJson, and the researchers watching it confirm the targets include healthcare organizations. Most dental practices have never heard of FastJson and will never install it on purpose. That is exactly why it is worth three minutes of your attention: the hardest software to protect is the software you do not know you are running.

What is actually happening

FastJson is an open-source Java library – a small, free building block that programs use to convert data to and from the JSON format. It is maintained by Alibaba and is embedded inside a great many applications, particularly enterprise and Chinese-origin software. On September 2026, an offensive-security firm published a technical write-up of a serious flaw, now tracked as CVE-2026-16723, affecting FastJson versions 1.2.68 through 1.2.83. Within days, security companies ThreatBook and Imperva reported it was being actively exploited in the wild against organizations across financial services, healthcare, computing and retail – almost entirely in the United States so far, with a handful of attacks already seen in Canada and Singapore, and expected to spread.

The flaw allows remote code execution with no user interaction and no need for elevated privileges. In plain terms: an attacker can send a specially crafted piece of data to a vulnerable, internet-facing application and make it run their code – no stolen password, no employee clicking a bad link, no warning. That combination is about as bad as a vulnerability gets. Worse, at the time of writing there was no patched release for the affected 1.x branch; the guidance is to move to the maintained successor library (fastjson2) and put network and web-application-firewall protections in front of anything exposed. A flaw that is unauthenticated, already exploited, and unpatched is the trifecta that gets defenders out of their chairs.

“So is this us?” – the honest answer

We would rather give you a straight answer than manufacture alarm. For a typical dental practice, the direct exposure to this specific flaw is low and, more importantly, uncertain. FastJson is a Java component, and the mainstream systems most Canadian practices run – Dentrix, Eaglesoft, Open Dental and their kin – are generally built on Microsoft’s .NET stack, not Java. So the odds that this exact library is sitting on your operatory PC are slim.

But notice the word “uncertain,” because that is the whole point. The reason nobody can hand you a confident “no” is that components like FastJson are buried invisibly inside other software – inside a vendor’s server product, an imaging or integration server, a web application your website runs on, or a system your IT or hosting provider operates on your behalf. The reflex “we don’t use Java, so this isn’t about us” is comforting and frequently wrong, because you did not choose these components and cannot see them from the login screen. We ran into the same theme when an open-source DICOM server flaw put imaging systems at risk: the vulnerable code was open-source plumbing tucked inside the imaging stack, not a product anyone consciously “installed.”

Why healthcare being on the list matters

Attackers do not spray these exploits at random; the industries researchers named are the industries being probed right now, and healthcare is on it. That is not a coincidence. Medical and dental organizations hold exactly the data extortion crews want – names, dates of birth, health and insurance details – and they have a low tolerance for downtime, which makes them more likely to pay to get running again. A no-click, no-password flaw in an internet-facing service is the kind of front door that lets an attacker skip the phishing email entirely. When a target list includes your sector, the right response is not panic but a quick, honest look at your own attack surface.

You cannot protect what you cannot see

Here is the lesson worth keeping long after CVE-2026-16723 is patched and forgotten. Modern software is assembled, not written – a single application can pull in dozens or hundreds of third-party open-source components, each with its own flaws surfacing on its own schedule. Your ability to respond to any given alert comes down to one unglamorous capability: knowing what you actually run. A practice that keeps even a basic inventory of its software and its internet-facing services can answer “is this us?” in an afternoon. A practice that does not is left guessing every single time the news breaks – and guessing, in security, usually means hoping. The same visibility gap shows up whenever practices bolt on new tools: every one of those integration bridges between imaging software and AI or practice-management systems quietly brings its own bundle of third-party code along with it.

What to do this week

None of this requires you to become a Java expert. It requires a few sensible questions and a little bookkeeping:

Write down what you run. Keep a simple, current list of your key software and – especially – anything that is reachable from the internet: your website, any remote-access or portal, imaging or integration servers. This one list is what turns future alerts from a scramble into a lookup.
Ask your vendors the direct question. Email your practice-management, imaging and integration vendors and ask plainly: do any of your products include FastJson 1.x, and if so, what is your fix or mitigation plan? A vendor who answers crisply has done the work; one who cannot has told you something too.
Ask your website and IT/hosting provider the same thing. Your public website and the environments your provider runs are the most likely places a Java component like this would live. Whoever manages them should be able to confirm they have assessed it.
Keep internet-facing services patched and, where possible, off the open internet. The services most exposed to a flaw like this are the ones facing the public web. Anything that does not need to be internet-reachable should not be, and the rest should be patched promptly and sit behind sensible protections. This is the same discipline we urged when a flaw turned up in backup software: treat every exposed service as software that will eventually have a bug.
File this as a rehearsal. FastJson may or may not touch you. The next component-level zero-day is a certainty. The practices that stay calm are the ones that already know what they run and have a habit of asking their vendors sharp questions.

What this means for your practice

CVE-2026-16723 is a flaw in software most dental offices will never knowingly touch, being used in attacks that specifically include healthcare. Both halves of that sentence are true, and the tension between them is the takeaway: the threat you cannot name is the one you cannot rule out. The answer is not fear – it is visibility. Know your software estate, know which of your services face the internet, and know that your vendors are watching the components buried in their own products. That awareness is also the backbone of a real business-continuity and downtime plan, because you cannot recover cleanly from a compromise in a system you did not know you had. Compudent Systems helps dental practices across the GTA and Ontario build and maintain exactly this picture – a clear inventory of software and internet-facing services, a hardened and patched attack surface, and a straight line to the vendor answers that alerts like this one demand. If you cannot say with confidence which of your systems this week’s alert does or does not touch, contact Compudent for a software-inventory and vendor-risk assessment. Knowing what you run is the cheapest security control there is – and the one too many practices skip.

Sources & further reading:

A Zero-Day Is Hitting Healthcare in Software Nobody Names: The FastJson Flaw (CVE-2026-16723) and Why You Can’t Protect Code You Don’t Know You Run