CVE-2026-16723: critical vulnerability in Alibaba Fastjson
Remote Code Execution in fastjson 1.2.68–1.2.83
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
75Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 9epss 0.7%
from disclosure to weaponsame day
Published on NVDJul 23
1st PoCJul 20
VulnCheckJul 23
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Alibaba · Fastjsonpublic PoCs found — 23
githubgithub.com/dinosn/fastjson-jsontype-rce-lab★ 206githubgithub.com/learner330/fastjson-cve-2026-16723★ 5githubgithub.com/why-success/fastjson-rce-lab★ 4githubgithub.com/1xPwn/CVE-2026-16723★ 2githubgithub.com/Nowafen/CVE-2026-16723★ 2githubgithub.com/yym8538/CVE-2026-16723★ 1githubgithub.com/EQSTLab/CVE-2026-16723★ 1githubgithub.com/fazilbaig1/CVE-2026-16723★ 1githubgithub.com/Superman-L/CVE-2026-16723★ 1githubgithub.com/HORKimhab/CVE-2026-16723★ 1githubgithub.com/xiaoqiMikko/fastjson-check★ 0githubgithub.com/cuttlefish520/FastJson1.2.83-GenProbe2★ 0githubgithub.com/ipisav/fastjson-cve★ 0vulncheckvulncheck.com/xdb/014b98d384ecunverifiedvulncheckvulncheck.com/xdb/897057d601c5unverifiedvulncheckvulncheck.com/xdb/af24389d997funverifiedvulncheckvulncheck.com/xdb/11a7c964ac31unverifiedvulncheckvulncheck.com/xdb/c94993ffec17unverifiedvulncheckvulncheck.com/xdb/29ad3d546741unverifiedvulncheckvulncheck.com/xdb/cb92ca1723e3unverifiedvulncheckvulncheck.com/xdb/116493e41914unverifiedvulncheckvulncheck.com/xdb/6332d3043de4unverifiedvulncheckvulncheck.com/xdb/71eb5c7ae6faunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Alibaba Fastjson
In the same product, most dangerous first.