Fastjson 1.x RCE CVE-2026-16723 Exploited, and There Is No Patch

CVE-2026-16723 is a CVSS 9.0 remote code execution flaw in Alibaba's Fastjson 1.x (versions 1.2.68 to 1.2.83) that works under the library's stock default configuration, with no AutoType required. Security firms report active exploitation of Spring Boot applications, and because Alibaba's fixes go to Fastjson 2, there is no patch for the 1.x branch. You cannot patch your way out of this one; you have to find and remove the component.

Researchers at ThreatBook and Imperva report attackers targeting CVE-2026-16723, a critical RCE (CWE-20, CVSS 9.0) in Fastjson, Alibaba's widely used JSON library for Java, affecting versions 1.2.68 through 1.2.83. What makes it different from Fastjson's long history of deserialization bugs is the precondition, or lack of one: historically these RCEs needed AutoType enabled or a specific gadget class on the path, and this one triggers under the stock default configuration. That removes the mitigation many teams assumed protected them and is why exploitation is landing against real Spring Boot stacks rather than lab setups.

What makes CVE-2026-16723 dangerous?

The combination of a default-config trigger and a dead branch. A deserialization RCE that needs no special settings is already serious; one with no upstream fix turns every unmigrated deployment into a standing liability. EPSS currently sits around the 34th percentile, which understates the picture given firms are reporting hands-on exploitation, and it reflects how badly probability models track a bug whose real risk is "unpatchable and already being used."

Any Java application still bundling Fastjson 1.x is exposed, which in practice is a large share of Spring Boot stacks. The dependency is frequently transitive and buried several layers down, so many teams ship it without knowing, which is exactly what makes an "are we affected?" question harder than it should be.

How do you fix Fastjson 1.x if there is no patch?

Because Alibaba has moved development to Fastjson 2, the real fix is to migrate off 1.x to a maintained version or replace it with another JSON library. That is not a same-day change, so the sequencing matters. First, find every place Fastjson 1.x is loaded, including transitive dependencies: a dependency-tree scan (for example mvn dependency:tree or gradle dependencies filtered for fastjson) surfaces the buried copies an SBOM may miss. Where you cannot migrate immediately, enable Fastjson's safeMode to block the deserialization gadget path and virtual-patch the affected input routes at a WAF. Treat those as containment while the migration proceeds, not as the fix.

Is Fastjson 1.x still widely used?

Yes, and that is the crux of the exposure. Migrating to Fastjson 2 carries breaking changes, so legacy 1.x lingers in production long after support ended. An unmaintained, internet-reachable deserialization library is precisely the kind of asset attackers count on: no vendor is going to ship you a fix, and the organizations running it are often the ones least likely to know they are.

Our read

This is the dependency-risk problem in its purest form: there is no patch to apply, so scanning for "missing patches" tells you nothing useful. The only defense is knowing where the vulnerable component actually runs and whether that code path is reachable from untrusted input, which is continuous verification of your real attack surface rather than a point-in-time CVE scan. Our analysis of the 2025 KEV catalog found that 67% of the vulnerabilities that were actually exploited would have been missed by an organization relying on an annual penetration test, and an unpatchable library buried in transitive dependencies is the textbook case of what those cycles overlook. You cannot remediate what your SBOM does not know you have, so make the inventory the first control, not an afterthought.

Reporting by The Hacker News, citing ThreatBook and Imperva; severity and affected versions per NVD. Sources linked above.

Related: SAP NetWeaver CVSS 9.9 flaw CVE-2026-44747 · GhostSplice: malicious MCP servers and the software supply chain