Vulnerability intelligence
CVE-2026-16723
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVSS Score
9
Critical
EPSS — Exploit Probability
16%
Riskier than 97% of all CVEs · checked 2026-09-08
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
2 articles across 2 outlets · first covered Jul 25, 2026 · latest Jul 28, 2026
Coverage timeline
-
Fastjson RCE flaw lets hackers run code on Java serverswww.securityweek.com · Jul 28, 2026
-
Urgent FastJson RCE flaw CVE-2026-16723 hits finance and healthsecurityonline.info · Jul 25, 2026