CVE-2026-16723: Fastjson — Remote Code Execution Risk (June 2026)

CVE-2026-16723 — Alibaba Fastjson

CVE-2026-16723 is a critical vulnerability in Fastjson (versions 1.2.68 to 1.2.83) that allows unauthenticated remote code execution under default configurations. This flaw is being actively exploited in the wild and poses a severe risk of full server compromise across multiple sectors. No authentication is required for exploitation, and attackers can gain complete control over affected systems.

Attack Vector

Attackers exploit Fastjson's deserialization process by sending crafted JSON payloads to vulnerable endpoints. When Fastjson processes these payloads under default settings, arbitrary code can be executed on the server. No prior authentication or special privileges are needed, making exploitation trivial for remote attackers. There are no specific IOCs published, but network traffic containing suspicious or unexpected JSON input to Fastjson endpoints should be scrutinized.

Who Is at Risk

All organizations running Fastjson versions 1.2.68 through 1.2.83 are at immediate risk. Confirmed affected entities include Alibaba and organizations across the US, Singapore, and Canada. Sectors impacted span business, computing, financial services, healthcare, and retail. Both public-facing and internal applications using vulnerable Fastjson versions are susceptible.

Patch & Mitigate

• Patch: Upgrade Fastjson to the latest available version beyond 1.2.83 immediately.
• Workaround: If patching is not possible, restrict access to endpoints using Fastjson and disable autoType where feasible.
• Detect: Monitor logs for unexpected deserialization errors, anomalous outbound connections, or suspicious JSON payloads sent to Fastjson endpoints.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed Fastjson endpoints to gain entry.
• TA0005 — Defense Evasion: Malicious payloads are crafted to bypass standard input validation.
• TA0009 — Collection: Full server compromise enables attackers to access sensitive data and credentials.

Source: https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/