type: cve · created: 2026-07-26 · updated: 2026-07-26 · tags: [cve, zero-day, rce, java, alibaba, fastjson, actively-exploited] · confidence: high · severity: critical · affected_sectors: [technology] · au_impact: true
CVE-2026-16723 — Fastjson 1.x Unauthenticated RCE
CVE-2026-16723 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in Alibaba's Fastjson 1.x Java JSON library, rated CVSS 9.0 (Critical). No patch for the 1.x branch is available as of July 2026.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-16723 |
| CVSS | 9.0 (Critical) |
| Type | Unauthenticated Remote Code Execution |
| Product | Alibaba Fastjson 1.x |
| Patch Status | No fixed version for 1.x branch — migrate to Fastjson2 |
| Active Exploitation | Yes — being actively targeted in the wild |
Mitigation
- Enable SafeMode in Fastjson 1.x configuration
- Migrate to Fastjson2 (the actively maintained fork)
Impact
Fastjson is a widely used JSON parsing library in the Java ecosystem. The lack of a patch for the widely deployed 1.x branch leaves many applications exposed to unauthenticated RCE attacks.
Sources
- The Hacker News — July 25, 2026