CVE-2026-16723 -- CVSS 9.0 Vulnerability Briefing

CVE-2026-16723 | CVSS 9.0 (Critical) | Exploit: PoC available

What Is It

CVE-2026-16723 is a critical remote code execution vulnerability affecting fastjson versions 1.2.68 through 1.2.83 when applications process attacker-controlled JSON input.

Technical Detail

The flaw permits remote code execution under fastjson's stock default configuration. Exploitation does not require AutoType to be enabled and does not depend on a classpath gadget. An attacker able to submit crafted JSON to a vulnerable application may execute code in the security context of the affected application process.

Exploitation Status

A proof of concept is available. CVE-2026-16723 is not listed in CISA's Known Exploited Vulnerabilities catalog as of July 28, 2026, and active exploitation in the wild has not been confirmed by the provided data.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Prioritize remediation for internet-facing applications and any service that accepts untrusted JSON. Upgrade or replace affected fastjson versions 1.2.68 through 1.2.83 with a version confirmed by the vendor or maintainer to address this issue. Do not rely on disabling AutoType as a mitigation, because the vulnerability is exploitable under the default configuration without AutoType enablement. Restrict untrusted access to JSON-processing endpoints where possible, review application logs for anomalous JSON requests, and monitor affected application hosts for unexpected process execution or outbound network activity. No CVE-specific indicators of compromise are provided in the available data.