<- ALL CYBER NEWS
Critical
Fastjson, CVE-2026-16723, RCE, Java, Spring Boot, deserialization, application security
Fastjson 1.x RCE CVE-2026-16723 Exploited, No Patch
CVE-2026-16723 is a CVSS 9.0 RCE in Fastjson 1.2.68-1.2.83 that works under stock default config. It is under active attack and the 1.x branch has no patch.
CVE-2026-16723 is a CVSS 9.0 remote code execution flaw in Alibaba's Fastjson 1.x (versions 1.2.68 to 1.2.83) that works under the library's stock default configuration - no AutoType needed. Security firms report active exploitation of Spring Boot applications, and because Alibaba's fixes go to Fastjson 2, there is no patch for the 1.x branch. You cannot patch your way out of this one.
What happened. Researchers at ThreatBook and Imperva report attackers targeting CVE-2026-16723, a critical RCE (CWE-20, CVSS 9.0) in Fastjson, Alibaba's widely used JSON library for Java. It affects fastjson 1.2.68 through 1.2.83 and is exploitable under the stock default configuration - historically Fastjson RCEs needed AutoType enabled or specific gadget classes; this one does not.
What makes CVE-2026-16723 dangerous?
Detail | Value |
|---|---|
CVE | CVE-2026-16723 |
CVSS | 9.0 Critical (CWE-20) |
Affected | fastjson 1.2.68 - 1.2.83 |
Condition | Stock default config (no AutoType required) |
Patch | None for the 1.x branch |
Seen in | Spring Boot applications, per ThreatBook and Imperva |
Who is affected. Any Java application still bundling Fastjson 1.x - which, in practice, is a large share of Spring Boot stacks. The dependency is often transitive and buried, so many teams do not know they ship it.
How do you fix Fastjson 1.x if there is no patch?
Because Alibaba has moved development to Fastjson 2, the fix is to migrate off 1.x to a maintained version, or replace it with another JSON library. Until then: find every place Fastjson 1.x is loaded (including transitive dependencies), and where you cannot migrate immediately, apply Fastjson's safeMode and virtual-patch the input paths at a WAF.
Is Fastjson 1.x still widely used?
Yes - and that is the story the community is debating. Migrating to Fastjson 2 carries breaking changes, so legacy 1.x lingers in production long after support ended. An unmaintained, internet-reachable deserialization library is exactly the exposure attackers count on.
Our read. This is the pure form of the dependency-risk problem: there is no patch to apply, so scanning for "missing patches" tells you nothing. The only defence is knowing where the vulnerable component actually runs and whether that path is reachable - continuous verification of your real attack surface, not a point-in-time CVE scan. You cannot remediate what your SBOM does not know you have.
Reporting by The Hacker News, citing ThreatBook and Imperva; severity and affected versions per NVD. Sources linked above.
Related: SAP NetWeaver CVSS 9.9 flaw and our KEV pentest analysis.