No fixed build or workaround is published yet. Limit exposure and watch for a patch.
Steps
Written by AI from the record
Check where Fastjson is used (your app, plugins, or dependencies) and confirm the Fastjson version is between 1.2.68 and 1.2.83.
If you are on 1.2.68–1.2.83, stop taking untrusted JSON inputs through that Fastjson code path immediately (block the endpoints, or temporarily disable features that parse attacker-controlled JSON).
Remove Fastjson from the affected component(s) by upgrading to a Fastjson release outside 1.2.68–1.2.83; if no fixed version is available for your stack, replace the JSON library used by your application.
Hunt for active exploitation by reviewing application and system logs for evidence of unusual JSON payloads and unexpected process/network activity after JSON parsing.
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
In plain language
Written by AI from the record
CVE-2026-16723 is a serious remote code execution flaw in Fastjson 1.2.68–1.2.83, and typical small businesses should treat it as urgent if they run software that uses this exact Fastjson version (it’s being exploited in the wild).
CVE-2026-16723 is an unauthenticated remote code execution issue in Fastjson (versions 1.2.68 through 1.2.83) triggered by crafted JSON input that abuses how the library processes certain data, and it is exploitable under Fastjson’s default configuration without AutoType enablement or classpath gadgets.
If you're affected
Full server takeover
Malware installation
Customer/employee data theft
Service disruption
What is it
Fastjson is a common software component used to read and understand JSON data. This vulnerability lets an attacker send a specially crafted JSON message to a vulnerable server and cause the server to run arbitrary code. Think of it like a “dangerous file reader” that can be tricked into doing whatever the attacker wants, not just reading data.
Who is affected
This matters to you if you run or host software that includes Fastjson version 1.2.68 through 1.2.83 (for example inside your application dependencies). It is a network-facing risk because an attacker can reach it by sending crafted JSON to the service that parses requests. It’s only a risk when that vulnerable Fastjson version is present and is reachable by untrusted input over the network (no login required).
How urgent is it
This is RED because the vulnerability is already being exploited in the wild against real organizations, and it allows remote attackers to run arbitrary code without any special configuration. If your environment includes Fastjson 1.2.68–1.2.83 and attacker-controlled JSON can reach it, treat this as an immediate emergency.
What to do — in detail
Confirm exposure
Identify every place Fastjson is present in your stack (application build artifacts, containers, application servers, and dependency bundles).
Confirm whether any deployed component uses Fastjson version 1.2.68, 1.2.69, …, 1.2.83.
Validate reachability: determine which network endpoints accept JSON from clients (web requests, API calls, message consumers, webhook receivers) and whether those inputs are parsed by the vulnerable Fastjson code path.
Prioritize mitigation (if affected)
Immediately restrict/disable the affected JSON-handling paths that process attacker-controlled data:
Temporarily block the relevant endpoints at the firewall/WAF level or application routing.
If you can’t block fully, add strict validation/allowlisting of accepted JSON formats and reject unexpected structures.
Keep the service available but reduce exposure: if there are internal-only endpoints, ensure they are not reachable externally.
Upgrade / replacement
Available reports did not include a specific fixed Fastjson version. Your goal is to:
Upgrade Fastjson to a version outside 1.2.68–1.2.83, or
Replace Fastjson in the application with a different JSON library if you cannot upgrade safely.
After change, re-check that the deployed artifact no longer contains the vulnerable version.
If patching is delayed: temporary workaround
Reduce the ability to send crafted JSON to the vulnerable parser by blocking the endpoints that use Fastjson for deserialization.
Add defensive request handling in front of the vulnerable parser (reject unexpected content types, enforce size limits, and fail closed on schema mismatch).
Investigate possible exploitation
Review logs around the time of the first known exposure and after any recent deployments:
Unexpected process execution events spawned by the application service.
Unusual outbound network connections initiated by the application.
Errors or spikes in JSON parsing activity tied to specific request patterns.
Check system/service logs for indicators that the server behavior changed after receiving JSON input.
What to monitor after you remediate
Continued attack attempts against the same endpoints (spike in rejected/blocked JSON requests).
Any persistence-like behavior (new scheduled tasks, new services, new files) that could indicate compromise.
Verify your upgraded/replaced dependency remains in place across all environments (dev/stage/prod) and containers/images.
Technical context
Summary
Vulnerability: Remote code execution (RCE) in Fastjson.
Under Fastjson’s default configuration, the crafted JSON can manipulate Fastjson’s handling into performing actions that lead to arbitrary code execution.
The findings state exploitation does not require AutoType enablement or classpath gadget conditions.
Exploitation status
Exploitation reported: YES (actively exploited in the wild since at least 2026-07-25), targeting U.S.-based organizations across multiple industries.
KEV: not listed in CISA KEV.
Public exploit code: not recorded.
Risk likelihood signals
KEV is not present, but real-world exploitation is confirmed by reporting, which raises practical risk.
EPSS is provided as a prediction, but public messaging here should focus on confirmed exploitation rather than predictions.
What KEV would mean here
KEV is a list of vulnerabilities the U.S. government has validated as being exploited; it is not currently listing this CVE, but exploitation reports still drive an emergency response because they indicate active abuse.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
