CVE-2026-16723
CVSS 9 CRITICAL: a remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. EPSS 16% (97th percentile), up from 0.4%.
Vulnerabilities · 48 days ago
The dangerous assumption is that turning off AutoType makes Fastjson safe. In Spring Boot fat-JAR deployments, a reachable JSON parser can still be driven into unauthenticated code execution with the Java process's privileges, and there is no fixed Fastjson 1.x release yet.
The flaw affects Fastjson 1.2.68 through 1.2.83 and has already shown up in real attacks. Alibaba says SafeMode is off by default, and the confirmed path works even with AutoType disabled and no classpath gadget, which is why patching to a simple 1.x fix is not an option today.
For teams that still run legacy Spring Boot fat-JAR services, the trust boundary is wrong: a parser meant to read data can become a code-loading path. That makes internet-facing JSON endpoints a live execution surface until the library is hardened or replaced.
CVSS 9 CRITICAL: a remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. EPSS 16% (97th percentile), up from 0.4%.
3 sources covering this story
Unpatched Fastjson Vulnerability Exploited in Attacks
The critical remote code execution bug can be exploited without authentication, under the library’s stock default configurations.
Hackers target US firms in FastJson RCE zero-day attacks
Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Fastjson 1.x flaw CVE-2026-16723 can trigger unauthenticated RCE in Spring Boot fat-JAR apps, with attacks reported and no patched 1.x fix available.
Part of the PlainSec briefing for 2026-07-29