CVE-2026-16723: Remote Code Execution in fastjson 1.2.68–1.2.83

Critical severity · published Jul 23, 2026

CVE-2026-16723

Remote Code Execution in fastjson 1.2.68–1.2.83

9.0

CVSS

0.7%

EPSS

On KEV

Description

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 51% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Fastjson · Alibaba

1.2.68 through 1.2.83 · source: vendor

In the news

VulnerabilityCritical

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires

CVE-2026-16723

Jul 25, 2026·The Hacker News

Affected product

Fastjson

Alibaba

All Fastjson CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-16723

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-16723

github.com

https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83