{"id":"CVE-2026-16723","aliases":["EUVD-2026-47929","GHSA-crf3-v9rr-v7hj"],"status":"published","title":"Remote Code Execution in fastjson 1.2.68–1.2.83","description":"A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00663,"percentile":0.52147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20","CWE-502"],"published":"2026-07-23T08:26:24Z","modified":"2026-10-24T13:10:00Z","exploits":[{"source":"pocgithub","id":"1xPwn/CVE-2026-16723","title":"1xPwn/CVE-2026-16723","date":"2026-07-30","url":"https://github.com/1xPwn/CVE-2026-16723"},{"source":"pocgithub","id":"EQSTLab/CVE-2026-16723","title":"EQSTLab/CVE-2026-16723","date":"2026-07-30","url":"https://github.com/EQSTLab/CVE-2026-16723"},{"source":"pocgithub","id":"Ethen1212/fastjson-CVE-2026-16723","title":"Ethen1212/fastjson-CVE-2026-16723","date":"2026-10-23","url":"https://github.com/Ethen1212/fastjson-CVE-2026-16723"},{"source":"pocgithub","id":"HORKimhab/CVE-2026-16723","title":"HORKimhab/CVE-2026-16723","date":"2026-07-25","url":"https://github.com/HORKimhab/CVE-2026-16723"},{"source":"pocgithub","id":"Superman-L/CVE-2026-16723","title":"Superman-L/CVE-2026-16723","date":"2026-08-19","url":"https://github.com/Superman-L/CVE-2026-16723"},{"source":"pocgithub","id":"cuttlefish520/FastJson1.2.83-GenProbe2","title":"cuttlefish520/FastJson1.2.83-GenProbe2","date":"2026-10-19","url":"https://github.com/cuttlefish520/FastJson1.2.83-GenProbe2"},{"source":"pocgithub","id":"dichen-L/CVE-2026-16723-vul","title":"dichen-L/CVE-2026-16723-vul","date":"2026-10-27","url":"https://github.com/dichen-L/CVE-2026-16723-vul"},{"source":"pocgithub","id":"dinosn/fastjson-jsontype-rce-lab","title":"dinosn/fastjson-jsontype-rce-lab","date":"2026-07-20","url":"https://github.com/dinosn/fastjson-jsontype-rce-lab"},{"source":"pocgithub","id":"fazilbaig1/CVE-2026-16723","title":"fazilbaig1/CVE-2026-16723","date":"2026-07-31","url":"https://github.com/fazilbaig1/CVE-2026-16723"},{"source":"pocgithub","id":"ipisav/fastjson-cve","title":"ipisav/fastjson-cve","date":"2026-08-28","url":"https://github.com/ipisav/fastjson-cve"},{"source":"pocgithub","id":"learner330/fastjson-cve-2026-16723","title":"learner330/fastjson-cve-2026-16723","date":"2026-08-05","url":"https://github.com/learner330/fastjson-cve-2026-16723"},{"source":"pocgithub","id":"why-success/fastjson-rce-lab","title":"why-success/fastjson-rce-lab","date":"2026-07-28","url":"https://github.com/why-success/fastjson-rce-lab"},{"source":"pocgithub","id":"xiaoqiMikko/fastjson-check","title":"xiaoqiMikko/fastjson-check","date":"2026-08-03","url":"https://github.com/xiaoqiMikko/fastjson-check"},{"source":"pocgithub","id":"yym8538/CVE-2026-16723","title":"yym8538/CVE-2026-16723","date":"2026-08-21","url":"https://github.com/yym8538/CVE-2026-16723"}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.alibaba:fastjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.68"},{"last_affected":"1.2.83"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.alibaba:fastjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.68"},{"last_affected":"1.2.83"}]}],"versions":["1.2.68","1.2.68.sec10","1.2.69","1.2.69_noneautotype","1.2.69_sec11","1.2.69_sec12","1.2.70","1.2.71","1.2.71_noneautotype","1.2.72","1.2.72_noneautotype","1.2.73","1.2.74","1.2.75","1.2.75_noneautotype","1.2.76","1.2.77","1.2.78","1.2.79","1.2.80","1.2.83"]}],"products":[{"vendor":"alibaba","product":"fastjson"}],"references":[{"url":"https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83","tags":["vendor-advisory","mitigation","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16723","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-crf3-v9rr-v7hj"},{"url":"https://github.com/alibaba/fastjson2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-16723","title":"Remote Code Execution in fastjson 1.2.68–1.2.83","description":"A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.","status":"published","published":"2026-07-23T08:26:24.453Z","modified":"2026-07-23T13:54:13.031Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-20","CWE-502"],"updated_at":"2026-11-02T14:20:11.24076Z"}],"euvd":[{"id":"EUVD-2026-47929","description":"A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.","status":"published","published":"2026-07-23T08:26:24Z","modified":"2026-07-23T13:54:13Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:44.021778Z"}],"ghsa":[{"id":"GHSA-crf3-v9rr-v7hj","title":"fastjson has a remote code execution (RCE) vulnerability","description":"A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.","status":"published","published":"2026-07-23T09:32:01Z","modified":"2026-08-07T18:18:20Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:40:58.888637Z"}],"nvd":[{"id":"CVE-2026-16723","description":"A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.","status":"published","published":"2026-07-23T09:16:26.7Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-20","CWE-502"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"GHSA-crf3-v9rr-v7hj","title":"fastjson has a remote code execution (RCE) vulnerability","description":"A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.","status":"published","published":"2026-07-23T09:32:01Z","modified":"2026-09-10T03:51:11.563486204Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:45.28161Z"}]}}