Remote Code Execution in fastjson 1.2.68–1.2.83
75Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 9epss 0.4%
from disclosure to weapon0 days
Published on NVDJul 23
1st PoCJul 20
VulnCheckJul 23
exploitation probability
0.4%top 66% of all CVEs
observed exploitation
yesVulnCheck
14 public exploit(s)
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Alibaba · Fastjsonpublic PoCs found — 14
githubgithub.com/dinosn/fastjson-jsontype-rce-lab★ 203githubgithub.com/why-success/fastjson-rce-lab★ 3githubgithub.com/learner330/fastjson-cve-2026-16723★ 3githubgithub.com/1xPwn/CVE-2026-16723★ 2githubgithub.com/Nowafen/CVE-2026-16723★ 2githubgithub.com/fazilbaig1/CVE-2026-16723★ 1githubgithub.com/HORKimhab/CVE-2026-16723★ 1githubgithub.com/EQSTLab/CVE-2026-16723★ 1githubgithub.com/xiaoqiMikko/fastjson-check★ 0vulncheckvulncheck.com/xdb/116493e41914unverifiedvulncheckvulncheck.com/xdb/71eb5c7ae6faunverifiedvulncheckvulncheck.com/xdb/af24389d997funverifiedvulncheckvulncheck.com/xdb/897057d601c5unverifiedvulncheckvulncheck.com/xdb/cb92ca1723e3unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.