WaratekVRT Sign in

CVE-2026-16723

Severity9.0 Critical CVSS 3.1
WeaknessDeserialization of untrusted data (CWE-502)
Published23 Jul 2026
Updated24 Oct 2026

Description

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

CWE-20 · Improper input validation

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 5 citations · 9 exploits · earliest 2026-07-23.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 14 indexed Published artifacts you can open, in GitHub PoC; first seen 2026-07-20.
  • EPSS 0.66% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2026-16723 in VulnCheck (free account), which lists 4 more exploit references not shown here.

EvidenceSourceDetailDate
Reported exploitation threatbook.io /blog/fastjson-rce-1.2.83-active-exploitation-detected-detection-mitigation 2026-07-23
Reported exploitation imperva.com /blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce 2026-07-23
Reported exploitation previdian.com /CVE-2026-16723 2026-07-25
Reported exploitation webflow.sysdig.com /blog/security-briefing-july-2026 2026-08-04
Reported exploitation recordedfuture.com /blog/july-2026-cve-landscape 2026-08-07
Exploit reference VulnCheck XDB 116493e41914 Exploit type: initial-access 2026-07-20
Exploit reference VulnCheck XDB 014b98d384ec Exploit type: initial-access 2026-07-30
Exploit reference VulnCheck XDB af24389d997f Exploit type: initial-access 2026-07-30
Exploit reference VulnCheck XDB 897057d601c5 Exploit type: initial-access 2026-07-31
Exploit reference VulnCheck XDB cb92ca1723e3 Exploit type: initial-access 2026-08-05

8 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@JSONType(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls. 207 2026-07-20
GitHub PoC learner330/fastjson-cve-2026-16723 5 2026-08-05
GitHub PoC Fastjson 1.2.83 RCE 靶场环境 (CVE-2026-16723) 4 2026-07-28
GitHub PoC A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83. 2 2026-07-30
GitHub PoC Fastjson RCE 2 2026-07-30
GitHub PoC CVE-2026-16723 Fastjson 1.2.68-1.2.83 ???? RCE ?? (java.lang.Class whitelist bypass) 1 2026-10-23
GitHub PoC yym8538/CVE-2026-16723 1 2026-08-21
GitHub PoC fastjson jsontype利用 1 2026-08-19
GitHub PoC This is N-day patch we releasing by testing our model capabilities 1 2026-07-31
GitHub PoC CVE-2026-16723 1 2026-07-25

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule

fastjson @type remote class loading: checkAutoType probes the attacker's type name, then TypeUtils.loadClass runs the fetched class's static initializer, and the Process rule (with /bin/, /usr/bin/ and C:\Windows\System32* listed) blocks its Runtime.exec. Attacker code that works inside the application without starting a program is not stopped.

How to mitigate CVE-2026-16723

Apply the vendor's fix. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.alibaba:fastjson 1.2.68 none 1.2.83

Products and versions

1 product, 1 version entry
SourceVendorProductSchemeAffected versions
osv com.alibaba fastjson generic ≥ 1.2.68 and ≤ 1.2.83

References

URLTags
https://github.com/alibaba/fastjson2 PACKAGE
https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83 WEB

Timeline
Published2026-07-23By the CVE Program.
VulnCheck KEV: earliest evidence2026-07-23Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Last VRT activity2026-09-30Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-10-24NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-10-27Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.