CVE-2026-16723 CVE Vulnerability Disclosures / 7h A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Back cve.report

CVE-2026-16723 CVE Vulnerability Disclosures / 7h A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

cve.report • July 23, 2026

Share: View original

Problem Types: CWE-20 | CWE-502 | CWE-20 CWE-20 Improper input validation | CWE-502 CWE-502 Deserialization of untrusted data

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CNA: Kirill Firsov of FearsOff Cybersecurity (en)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in fastjson Disclosed (CVE-2026-16723) A remote code execution (RCE) vulnerability, CVE-2026-16723, has been identified in fastjson versions 1.2.68 to 1.2.83. This vulnerability can be exploited without requiring AutoType enablement or classpath gadgets, making it particularly dangerous. An unauthenticated attacker can execute arbitrary code on systems using the affected library over the network. The CVSS score for this vulnerability is 9.0, indicating a severe risk. Currently, there is no evidence of public proof-of-concept or confirmed exploitation. Cybersecurity professionals are urged to update fastjson to versions beyond 1.2.83 and restrict network access to vulnerable applications. The vulnerability was published on July 23, 2026, and is considered an immediate threat requiring urgent mitigation. 9 sources 74

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CWE Weaknesses (2)

CWE-20 - Improper Input Validation CWE-502 - Deserialization Of Untrusted Data