Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Fastjson RCE flaw lets hackers run code on Java servers

Part of the Fastjson story · since 22 Jul

Quiet for 14 weekslast report 28 Jul4 articles3 outlets
22 Jul · SecurityOnline first11 Sep28 Sep15 OctNowThis article4th of 4
  • Wed 22 Jul, 14:31 UTC. SecurityOnline, first report. Fastjson 1.2.68 to 1.2.83 hit by critical RCE flaw, PoC available.
  • Sat 25 Jul, 04:50 UTC. SecurityOnline. Urgent FastJson RCE flaw CVE-2026-16723 hits finance and health.
  • Sat 25 Jul, 13:40 UTC. The Hacker News, its first report on the story. Unpatched Fastjson flaw lets attackers run code remotely.
  • Tue 28 Jul, 07:57 UTC. SecurityWeek, its first report on the story. Fastjson RCE flaw lets hackers run code on Java servers. This article, 4th of 4.

A critical remote code execution (RCE) vulnerability in the Fastjson library (CVE-2026-16723) has been exploited, impacting all versions from 1.2.68 to 1.2.83. Designed for JSON processing in Java, Fastjson allows attackers to execute arbitrary code without authentication, posing risks to server integrity and confidentiality. Exploits have targeted sectors including healthcare and finance, with attacks primarily originating from browser impersonators.

Organizations are advised to upgrade to Fastjson 2.x or implement mitigation measures such as enabling SafeMode. The situation is prioritized for remediation due to the vulnerability’s severe nature.

How the story developed

All 4 articles
Quiet for 14 weekslast report 28 Jul4 articles3 outlets

4 articles from 3 outlets since 22 Jul. Quiet since 28 Jul. This was the 4th report, 6 days after the first.

Now22 Jul23242526272829First reportSecurityOnline · 22 Jul, 14:31This article4th of 4 · day 6Picked up againafter 3 days quiet
  • Wed 22 Jul, 14:31 UTC. SecurityOnline, first report. Fastjson 1.2.68 to 1.2.83 hit by critical RCE flaw, PoC available.
  • Sat 25 Jul, 04:50 UTC. SecurityOnline. Urgent FastJson RCE flaw CVE-2026-16723 hits finance and health.
  • Sat 25 Jul, 13:40 UTC. The Hacker News, its first report on the story. Unpatched Fastjson flaw lets attackers run code remotely.
  • Tue 28 Jul, 07:57 UTC. SecurityWeek, its first report on the story. Fastjson RCE flaw lets hackers run code on Java servers. This article, 4th of 4.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 4 articles as a list
  1. Wed 22 JulDay 01
    1. Fastjson 1.2.68 to 1.2.83 hit by critical RCE flaw, PoC available14:31 · SecurityOnline · First report

  2. Quiet for 3 days

    Sat 25 JulDay 32
    1. Urgent FastJson RCE flaw CVE-2026-16723 hits finance and health04:50 · SecurityOnline · Picked up again
    2. Unpatched Fastjson flaw lets attackers run code remotely13:40 · The Hacker News

  3. Quiet for 3 days

    Tue 28 JulDay 61
    1. Fastjson RCE flaw lets hackers run code on Java servers07:57 · SecurityWeek · Picked up again · This article, 4th of 4

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in