CVE-2026-16723 | defend.network

What is CVE-2026-16723?

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

CVSS9 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS<1% · P34

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWECWE-20

NVD published2026-07-23

NVD last modified2026-07-23

Timeline

2026-07-23Published to the U.S. National Vulnerability Database (NVD)
2026-07-26First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Isolate Spring Boot applications using Fastjson from untrusted networks immediately
Implement strict input validation and WAF rules to reject suspicious JSON payloads
Monitor for exploitation attempts and disable JSON deserialization features if not required
Prepare for vendor patch release and apply as soon as available
Consider use of alternative JSON libraries until patch is released

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of July 2026 (July 20 – 26)
Fastjson RCE under attack, no patch; GitLab exploit public; PTC manufacturing targeted (2026-07-26)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.