CVE-2026-16723 AKAOMA CVE VULNERABILITIES / 7h A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Back cve.akaoma.com

CVE-2026-16723 AKAOMA CVE VULNERABILITIES / 7h A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

cve.akaoma.com • July 23, 2026

Share: View original

9.0 /10 Severe Risk Cybersecurity professionals consider CVE-2026-16723 an immediate threat requiring urgent mitigation.

Cybersecurity professionals consider CVE-2026-16723 an immediate threat requiring urgent mitigation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in fastjson Disclosed (CVE-2026-16723) A remote code execution (RCE) vulnerability, CVE-2026-16723, has been identified in fastjson versions 1.2.68 to 1.2.83. This vulnerability can be exploited without requiring AutoType enablement or classpath gadgets, making it particularly dangerous. An unauthenticated attacker can execute arbitrary code on systems using the affected library over the network. The CVSS score for this vulnerability is 9.0, indicating a severe risk. Currently, there is no evidence of public proof-of-concept or confirmed exploitation. Cybersecurity professionals are urged to update fastjson to versions beyond 1.2.83 and restrict network access to vulnerable applications. The vulnerability was published on July 23, 2026, and is considered an immediate threat requiring urgent mitigation. 9 sources 74

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)