CVE-2026-16723 — Remote Code Execution in fastjson 1.2.68–1.2.83

CVE-2026-16723

Remote Code Execution in fastjson 1.2.68–1.2.83 PUBLISHED

Description (CNA)

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Affected (CNA)

Vendor / product	Versions
Alibaba / Fastjson	affected 1.2.68 through 1.2.83

CWE

CWE-20, CWE-502

References

https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.