CVE-2026-16723

Critical9.0 Published on Jul 23, 2026

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Early warning: exploitation observed

Exploitation observed since Jul 23, 2026
Not yet in the official CISA catalogue
Attacked on the day of disclosure

Source: VulnCheck KEV · Aug 7, 2026 Aug 4, 2026 Jul 25, 2026 Jul 23, 2026 Jul 23, 2026

CVSS score9.0 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-20, CWE-502

Vulnerabilities

CVE-2026-16723: Critical RCE in Fastjson 1.x, Active Exploitation in Spring Boot Environments

CVE-2026-16723 is a critical Fastjson 1.x RCE flaw exploited in Spring Boot fat-JAR apps. Learn how it works and mitigate risks by enabling SafeMode.

Jul 26, 202615:10 3 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

CVE-2026-16723: Critical RCE in Fastjson 1.x, Active Exploitation in Spring Boot Environments