CVE-2026-16723

CRITICAL9.0Published on July 23, 2026

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

CVSS score9.0 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-20, CWE-502

Fastjson 1.x nel mirino degli attaccanti: exploit RCE senza patch minaccia i sistemi Java

Vulnerabilities

CVE-2026-16723: Critical RCE in Fastjson 1.x, Active Exploitation in Spring Boot Environments

CVE-2026-16723 is a critical Fastjson 1.x RCE flaw exploited in Spring Boot fat-JAR apps. Learn how it works and mitigate risks by enabling SafeMode.

Jul 26, 20263 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

CVE-2026-16723: Critical RCE in Fastjson 1.x, Active Exploitation in Spring Boot Environments