CVE-2026-16723: RCE in fastjson, CRITICAL vulnerability

CVE-2026-16723 is a Remote Code Execution (RCE) flaw of CRITICAL severity (CVSS 9.0) affecting fastjson versions 1.2.68 through 1.2.83. The most critical characteristic is that the flaw is exploitable in default configuration, requiring neither AutoType enablement nor gadget chain presence in the classpath: this means that the vast majority of deployments are potentially exposed right from installation.

The vulnerability, published to NVD on July 23, 2026, was assigned CVSS 9.0 (CRITICAL). Posts on X indicate that as of October 31, 2026, the community continues to discuss this CVE; one of the most cited posts references a case of exploitation on high-profile infrastructure (information not verified in official sources). Official sources have not reported details on a definitive fix or patch date.

Defensive teams must: 1) execute a complete inventory of fastjson in production environments, highlighting all instances of versions 1.2.68-1.2.83; 2) consult official fastjson channels to identify the correct version and patch timing; 3) plan a priority upgrade for the affected versions, given the CRITICAL value of the CVE; 4) monitor access logs and anomalous behavior to detect exploitation attempts until the upgrade is completed.