Remote Code Execution in fastjson 1.2.68–1.2.83
80Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 9epss 16%
from disclosure to weapon0 days
Published on NVDJul 23
1st PoCJul 20
VulnCheckJul 23
exploitation probability
16%top 3% of all CVEs
observed exploitation
yesVulnCheck
17 public exploit(s)
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Alibaba · Fastjsonpublic PoCs found — 17
githubgithub.com/dinosn/fastjson-jsontype-rce-lab★ 205githubgithub.com/learner330/fastjson-cve-2026-16723★ 5githubgithub.com/why-success/fastjson-rce-lab★ 4githubgithub.com/1xPwn/CVE-2026-16723★ 2githubgithub.com/Nowafen/CVE-2026-16723★ 2githubgithub.com/HORKimhab/CVE-2026-16723★ 1githubgithub.com/EQSTLab/CVE-2026-16723★ 1githubgithub.com/fazilbaig1/CVE-2026-16723★ 1githubgithub.com/ipisav/fastjson-cve★ 0githubgithub.com/xiaoqiMikko/fastjson-check★ 0githubgithub.com/Superman-L/CVE-2026-16723★ 0vulncheckvulncheck.com/xdb/897057d601c5unverifiedvulncheckvulncheck.com/xdb/af24389d997funverifiedvulncheckvulncheck.com/xdb/71eb5c7ae6faunverifiedvulncheckvulncheck.com/xdb/cb92ca1723e3unverifiedvulncheckvulncheck.com/xdb/29ad3d546741unverifiedvulncheckvulncheck.com/xdb/116493e41914unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.