CVE-2026-16723

CriticalCVSS 9.0

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

48th percentile - higher than 48% of all known CVEs

Summary

A remote code execution (RCE) vulnerability in fastjson versions 1.2.68 through 1.2.83. The vulnerability is exploitable under default configuration, without requiring AutoType enablement or classpath gadgets.

Risk Assessment

An attacker can remotely execute arbitrary code on a server using a vulnerable version of fastjson, potentially leading to full system compromise.

Recommendation

It is recommended to upgrade fastjson to a version later than 1.2.83 that fixes this vulnerability.

Original NVD description (English source)

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.