CVE-2026-16723— Remote Code Execution in fastjson 1.2.68–1.2.83

CVSS 9.0 · Critical EPSS 0.66% · P48 Updated Jul 23, 2026

Possible ATT&CK Techniques 2AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Alibaba	Fastjson	`1.2.68≤ 1.2.83`	affected

Get alerts for future matching vulnerabilitiesLog in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Remote Code Execution in fastjson 1.2.68–1.2.83

Source: CVE Program / CVE List V5

Vulnerability Description

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Alibaba	Fastjson	1.2.68 ~ 1.2.83	-

II. Public POCs for CVE-2026-16723

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

Qwen3.6-35B-A3B · 9736 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-16723

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-16723 (1)

🔗 Security Advisory: Remote Code Execution in fastjson 1.2.68–1.2.83 · alibaba/fastjson2 Wiki · GitHub Read full article vendor-advisorymitigation

https://www.cve.org/CVERecord?id=CVE-2026-16723

IV. Related Vulnerabilities

Same product: Fastjson

CVE-2025-70974
Fastjson 安全漏洞

Same vendor: Alibaba

Same weakness: CWE-20

V. Comments for CVE-2026-16723

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-16723— Remote Code Execution in fastjson 1.2.68–1.2.83

Possible ATT&CK Techniques 2AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-16723

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-16723

III. Intelligence Information for CVE-2026-16723

Vendor Advisories for CVE-2026-16723 (1)

IV. Related Vulnerabilities

V. Comments for CVE-2026-16723

Leave a comment