CVE-2026-16723
CVSS 9 CRITICAL: a remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. EPSS 16% (97th percentile), up from 0.4%.
Vulnerabilities & Exploits
The dangerous assumption is that turning off AutoType makes Fastjson safe. In Spring Boot fat-JAR deployments, a reachable JSON parser can still be driven into unauthenticated code execution with the Java process's privileges, and there is no fixed Fastjson 1.x release yet.
The flaw affects Fastjson 1.2.68 through 1.2.83 and has already shown up in real attacks. Alibaba says SafeMode is off by default, and the confirmed path works even with AutoType disabled and no classpath gadget, which is why patching to a simple 1.x fix is not an option today.
For teams that still run legacy Spring Boot fat-JAR services, the trust boundary is wrong: a parser meant to read data can become a code-loading path. That makes internet-facing JSON endpoints a live execution surface until the library is hardened or replaced.
3 sources · Jul 28
CVSS 9 CRITICAL: a remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. EPSS 16% (97th percentile), up from 0.4%.
SecurityWeek
Unpatched Fastjson Vulnerability Exploited in Attacks
The critical remote code execution bug can be exploited without authentication, under the library’s stock default configurations.
originalBleepingComputer
Hackers target US firms in FastJson RCE zero-day attacks
Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.
originalThe Hacker News
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Fastjson 1.x flaw CVE-2026-16723 can trigger unauthenticated RCE in Spring Boot fat-JAR apps, with attacks reported and no patched 1.x fix available.
originalPart of the PlainSec briefing for 2026-07-27
Every edition of this story: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass