CVE-2026-16723

CRITICAL EXPLOITED LAB

Remote Code Execution in fastjson 1.2.68–1.2.83

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-16723 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including dinosn, why-success, HORKimhab.

AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2026-16723, a remote code execution vulnerability in Fastjson 1.2.83 via unsafe @JSONType deserialization. The exploit leverages a jar: URL in the @type field to trigger class loading from an attacker-controlled server, bypassing autoType restrictions on JDK 8.

Description

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Exploits (3)

nomisec WORKING POC 176 stars
by dinosn · poc
https://github.com/dinosn/fastjson-jsontype-rce-lab

This repository provides a functional proof-of-concept for CVE-2026-16723, a remote code execution vulnerability in Fastjson 1.2.83 via unsafe @JSONType deserialization. The exploit leverages a jar: URL in the @type field to trigger class loading from an attacker-controlled server, bypassing autoType restrictions on JDK 8.

Classification
Working Poc 99%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Fastjson 1.2.83 (with autoType disabled or misconfigured)
No auth needed
Prerequisites: Target must be running Fastjson 1.2.83 with autoType disabled or misconfigured (e.g., via autoTypeFilter allowlist bypass) · Target must be using JDK 8 (JDK 17+ limits impact to SSRF) · Network egress to attacker-controlled server
mistral-large-3 · analyzed Jul 27, 2026 Full analysis →
nomisec WORKING POC
by why-success · poc
https://github.com/why-success/fastjson-rce-lab

This repository provides a vulnerable lab environment for CVE-2026-16723, a remote code execution (RCE) vulnerability in Fastjson 1.2.68-1.2.83. The exploit leverages Fastjson's checkAutoType mechanism to load a remote JAR via LaunchedURLClassLoader, bypassing SafeMode and AutoType restrictions using @JSONType annotation as a trust signal.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Fastjson 1.2.68-1.2.83
No auth needed
Prerequisites: Fastjson SafeMode disabled (default state) · Application running as Spring Boot fat-JAR (LaunchedURLClassLoader present) · JDK 8 (JDK 9+ limits to SSRF)
mistral-large-3 · analyzed Jul 28, 2026 Full analysis →
github STUB
by HORKimhab · poc
https://github.com/HORKimhab/CVE-2026-16723

This repository contains no actual exploit code, technical details, or vulnerability analysis for CVE-2026-16723. It only includes a README with donation requests, legal disclaimers, and placeholder instructions without any functional implementation.

Classification
Stub 95%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unspecified
No auth needed
mistral-large-3 · analyzed Jul 25, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 9.0
EPSS 0.0041
EPSS Percentile 33.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Lab Environment

COMMUNITY
Community Lab
docker pull eclipse-temurin:8-jdk
docker pull eclipse-temurin:17.0.19_10-jre-jammy@sha256:475d8e96b4b2bfe08999e5e854755c773af1581acdf959a4545d88f0696a2339

Details

VulnCheck KEV 2026-07-23
CWE
CWE-20 CWE-502
Status published
Products (1)
Alibaba/Fastjson 1.2.68 - 1.2.83
Published Jul 23, 2026
Tracked Since Jul 23, 2026