Remote code execution vulnerability in fastjson versions 1.2.68 through 1.2.83 that is exploitable under default configuration without requiring AutoType enablement or classpath gadgets.
An unauthenticated attacker over the network can execute arbitrary code on the system running the affected fastjson library.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Update fastjson to a version beyond 1.2.83. Restrict network access to applications using fastjson. Monitor for exploitation attempts targeting the affected versions.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-16723 . See article
NVD published the first details for CVE-2026-16723
A CVSS base score of 9 has been assigned.
GitHub Advisories released a security advisory .
[GHSA-crf3-v9rr-v7hj] A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.
[GHSA-crf3-v9rr-v7hj] A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
