CVE-2026-16723
Remote Code Execution in fastjson 1.2.68–1.2.83
CRITICAL 9.0EPSS 0.7%
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
- Affected
- Alibaba · Fastjson
- CVSS v3.1 LIST
- 9.0 CRITICAL
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.66% chance of exploitation in the next 30 days, 51st percentile
- Published
- 2026-07-23
Proof-of-concept exploits (9)
- 1xPwn/CVE-2026-167233★ · 2026-09-30
- HORKimhab/CVE-2026-167231★ · 2026-07-26
- EQSTLab/CVE-2026-167231★ · 2026-07-30
- learner330/fastjson-cve-2026-167235★ · 2026-08-12
- ipisav/fastjson-cve0★ · 2026-08-28
- Superman-L/CVE-2026-167231★ · 2026-08-19
- mekrina/fastjson-1.2.83-rce-research0★ · 2026-08-21
- yym8538/CVE-2026-167231★ · 2026-08-21
- Ares-X/VulWiki224★ · 2026-10-14