What is the CVSS score of CVE-2026-16723?

CVE-2026-16723 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of fastjson are affected by CVE-2026-16723?

Alibaba fastjson versions 1.2.68-1.2.83 contain a critical remote code execution vulnerability affecting any application processing untrusted JSON input without requiring authentication.

Is there a public PoC exploit available for CVE-2026-16723?

Yes, a public proof-of-concept exploit is available for CVE-2026-16723. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-16723?

Within 24 hours, conduct an inventory of all systems running fastjson versions 1.2.68-1.2.83 and assess network exposure for any internet-facing or untrusted-input-processing endpoints. Within 7 days, implement network segmentation to restrict access to JSON deserialization services, deploy strict input validation to reject suspicious payloads, and evaluate downgrade feasibility to fastjson versions prior to 1.2.68 while testing backward compatibility in lower-risk environments. Within 30 days, establish automated deployment pipelines for rapid patching once a vendor fix becomes available, conduct architectural reviews to identify which applications can tolerate older fastjson versions, and document a formal escalation plan for systems that cannot be remediated through downgrade or isolation, preparing executive communication for potential extended risk acceptance.

fastjson CVE-2026-16723

EUVD-2026-47929 CRITICAL

Improper Input Validation (CWE-20)

2026-07-23 alibaba

GHSA-crf3-v9rr-v7hj

RCE Fastjson Red Hat

9.0

CVSS 3.1 · Vendor: alibaba

Severity by source

Vendor (alibaba) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network-reachable unauthenticated deserialization (AV:N/PR:N); AC:H because a payload must defeat fastjson's default hardening; RCE breaking out of the parser justifies S:C and full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (alibaba).

CVSS VectorVendor: alibaba

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 09:00 vuln.today

CVE Published

Jul 23, 2026 - 08:26 cve.org

CRITICAL 9.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

733 maven packages depend on com.alibaba:fastjson (252 direct, 488 indirect)

Ecosystem-wide dependent count for version 1.2.68.

DescriptionCVE.org

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration - no AutoType enablement required, no classpath gadget required.

AnalysisAI

Remote code execution in Alibaba fastjson versions 1.2.68 through 1.2.83 allows remote, unauthenticated attackers to run arbitrary code by submitting crafted JSON to any endpoint that deserializes untrusted input. The vendor advisory emphasizes that exploitation works under fastjson's stock default configuration - AutoType does not need to be enabled and no external classpath gadget is required - which removes the mitigations most defenders historically relied on. No public exploit identified at time of analysis, but the CVSS 9.0 rating and scope change (S:C) mark this as a high-priority deserialization flaw.

Technical ContextAI

fastjson is a widely used high-performance Java JSON library from Alibaba for serializing and deserializing objects. This issue is classified as CWE-20 (Improper Input Validation): during deserialization, attacker-controlled JSON is able to influence object instantiation in a way that leads to code execution even without the AutoType feature that earlier fastjson RCE chains depended on. Historically fastjson RCEs required AutoType to be enabled and a known gadget on the classpath; the significance here per the advisory is that neither precondition is needed, so the library's default input handling itself is the root cause. Affected artifacts match CPE cpe:2.3:a:alibaba:fastjson:*, i.e. the fastjson 1.x line specifically in the 1.2.68-1.2.83 band.

RemediationAI

Patch available per vendor advisory: follow Alibaba's guidance in the fastjson2 security advisory (https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83), whose primary recommended fix is to migrate from the legacy fastjson 1.x line to fastjson 2, where the deserialization model is redesigned; an exact patched 1.x release version is not independently confirmed from the provided data. As compensating controls while migration is planned, enable fastjson safeMode (ParserConfig.getGlobalInstance().setSafeMode(true)) to globally block the deserialization path that leads to code execution - note this disables AutoType-based polymorphic deserialization entirely and may break code that relies on type hints in JSON. Additionally, restrict which services accept untrusted JSON: put endpoints that deserialize external input behind authentication and network ACLs, and validate/whitelist expected types before parsing, accepting the trade-off of added request handling complexity. Do not rely on merely disabling AutoType, since the advisory states exploitation does not require AutoType.