fastjson CVE-2026-16723

Exploitation requires only that the target application uses fastjson 1.2.68 through 1.2.83 to deserialize attacker-supplied JSON, and per the advisory works against fastjson's stock default configuration - AutoType does not need to be enabled and no gadget class needs to be present on the classpath. The attacker must be able to reach an endpoint that passes untrusted input into fastjson (e.g. JSON.parse/parseObject on a request body). Limiting factors: exploitation is rated high complexity (AC:H), meaning a reliable payload must overcome fastjson's built-in denylist/safeMode-style defenses; the affected version band is specific (1.x 1.2.68-1.2.83), so deployments on fastjson 2 or on the legacy line with safeMode explicitly enabled are not exploitable via this path.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) indicates a network-reachable, unauthenticated flaw with full confidentiality, integrity and availability impact and a scope change, tempered only by high attack complexity. AC:H is consistent with the reality that fastjson ships hardening (safemode, denylists) that a working exploit must defeat, so weaponization is non-trivial rather than trivial. No EPSS score, no KEV listing, and no POC were provided, so exploitation is currently theoretical from the data available - this is a real priority because of the default-configuration reachability and the library's large Java footprint, not because active exploitation is confirmed. The absence of a published gadget/POC is the main factor keeping near-term mass-exploitation likelihood uncertain; treat AC:H as a speed bump, not a safeguard, given the vendor itself reported the issue.

An attacker sends a crafted JSON payload to any internet-reachable service that parses request bodies with a vulnerable fastjson 1.2.68-1.2.83 instance, without needing credentials or any special server configuration. Successful parsing triggers unintended object handling that results in arbitrary code execution in the application's context. No public exploit is identified at time of analysis, and the high attack complexity implies a working payload requires defeating fastjson's built-in defenses.