Published Friday, July 24, 2026 at 03:12 PM PT

<strong>CVE-2026-16723: Critical FastJson RCE — Immediate Patching Required</strong>

BLUF: Critical zero-day remote code execution vulnerability disclosed in FastJson 1.2.68–1.2.83 (CVSS 9.0). Java applications using Spring Boot are affected. Inventory and patch all affected instances immediately; exploitation is trivial and active exploitation should be assumed imminent.

DETAILS

• Vulnerability: Unsafe deserialization in FastJson JSON processing library enables unauthenticated remote code execution when application processes untrusted JSON input.

• Affected versions: FastJson 1.2.68 through 1.2.83 under Spring Boot deployment conditions. Exact trigger conditions not fully detailed in available advisory; requires verification against your Spring Boot configuration.

• CVSS score: 9.0 (Critical) — highest severity tier.

• Public disclosure: Zero-day status as of source date. Public proof-of-concept expected within hours to days; assume active exploitation possible.

• Deployment vector: Vulnerability is exploitable via any application endpoint accepting JSON input (REST APIs, webhooks, message handlers).

IMPACT

Who: All Java services using FastJson 1.2.68–1.2.83 in Spring Boot; affects both on-premises and cloud-hosted deployments.

What: Unauthenticated remote code execution with application-level privileges. Attacker can execute arbitrary code on the host system.

Scope: Unknown scale; FastJson is a widely adopted library in the Java ecosystem. If your organization uses Spring Boot frameworks, assess likelihood of FastJson presence.

RECOMMENDED ACTIONS

  1. Immediate (next 2 hours): Inventory all Java services for FastJson dependency version. Use dependency scanning tools (Maven dependency:tree, Gradle dependencies, SCA vendors).

  2. Urgent (within 4 hours): Patch FastJson to 1.2.84+ (or later). Coordinate with deployment pipeline to minimize downtime.

  3. Parallel: Monitor application logs and WAF/IDS for JSON deserialization payloads or exploitation attempts (watch for fastjson, @type, or Base64 gadget chains in POST/PUT bodies).

  4. If patching is delayed: Implement temporary request filtering to reject JSON payloads with suspicious deserialization markers (@type fields, gadget class names). This is NOT a substitute for patching.

  5. Post-patch: Scan logs for historical exploitation attempts dating back 30+ days (zero-day may have had shadow exploitation).

SOURCES

Imperva threat advisory; CVE-2026-16723; CVSS National Vulnerability Database.

Uncertainty flag: Available advisory text truncates after “specific Spring Boot deployment conditions.” Confirm your Spring Boot version compatibility and environment against vendor patch guidance before deploying.

Recent high-severity events at publish time:

Recent high-severity events