CVE-2026-16723
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A remote code execution (RCE) vulnerability in fastjson versions 1.2.68 through 1.2.83. The vulnerability is exploitable under default configuration, without requiring AutoType enablement or classpath gadgets.
Risk Assessment
An attacker can remotely execute arbitrary code on a server using a vulnerable version of fastjson, potentially leading to full system compromise.
Recommendation
It is recommended to upgrade fastjson to a version later than 1.2.83 that fixes this vulnerability.
Other vulnerabilities in fastjson
See all- CVE-2025-70974Critical
Vulnerability in Fastjson before version 1.2.48 allows an attacker to perform JNDI injection by manipulating the @type key in a JSON document. The attacker can invoke public methods of a specified Java class, leading to remote code execution. This flaw was actively exploited in the wild from 2023 to 2025.
- CVE-2024-23052Critical
A vulnerability in WukongCRM version 72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
Original NVD description (English source)
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.