External risk intelligence

Fastjson RCE Vulnerability in versions 1.2.68 through 1.2.83

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-16723

Fastjson is a widely used Java library integrated into numerous internet-facing web applications and APIs for JSON processing. Because it is frequently embedded in components that handle external HTTP requests directly, the vulnerable surface is commonly reachable from the public internet in standard deployment patterns.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a widely used Java library for processing JSON data, potentially allowing attackers to execute arbitrary code remotely. This issue is particularly concerning as it can be exploited without requiring special configurations or additional components, meaning it could be accessible through standard web applications and APIs. The main concern is confirming relevance and exposure, as the library's common integration into internet-facing systems presents a widespread risk.

Remote code execution is possible.
It affects a common data processing library.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by sending specially crafted JSON data to an application that uses a vulnerable version of fastjson. This can occur without requiring special configuration or additional libraries, potentially leading to the attacker executing arbitrary code on the affected system.

Network access required.
Specially crafted JSON data.
Arbitrary code execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code when a vulnerable version of fastjson processes specially crafted JSON data. The attacker could potentially impact the integrity and availability of the system, and may be able to access sensitive information.

System data and service behavior are at risk.
Malicious JSON input could trigger code execution.
Unauthorized code execution could compromise the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical remote code execution vulnerability in fastjson impacts applications that process JSON, particularly those with default configurations. Identifying where this library is deployed, confirming its exposure and business criticality, and locating the accountable owner are the immediate first steps. Subsequent remediation planning should be risk-based.

Application owners should own the issue.
Verify fastjson exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is fastjson?

Fastjson is a Java library designed to convert Java objects into JSON format and vice versa. Developers integrate it into web applications and APIs to manage data exchange efficiently. Because it is a foundational component for parsing incoming data, it is embedded deeply within many software architectures that handle web requests.

What is the vulnerability in CVE-2026-16723?

This vulnerability is classified as Improper Input Validation and Deserialization of Untrusted Data. It allows an attacker to send malicious JSON input that the library processes in a way that executes unauthorized commands on the host system. It essentially tricks the software into running unintended instructions instead of just reading data.

How does an attacker trigger this CVE-2026-16723 bug?

An attacker triggers this by sending a specially crafted JSON payload to an application using a vulnerable fastjson version. Crucially, the vulnerability does not require any special security misconfigurations or specific environment setups; it is exploitable in the library's default state.

Why is this CVE-2026-16723 a concern for my systems?

According to Halo Surface Signal, fastjson is frequently used in internet-facing web applications to handle external requests. If your services process JSON from the public internet, they are at higher risk because they provide a direct path for an attacker to reach the vulnerable component.

What should I do if I use fastjson?

Begin by inventorying your applications to identify which ones utilize fastjson versions 1.2.68 through 1.2.83. Once you locate the affected systems, evaluate their business criticality and internet exposure to prioritize your response. Coordinate with the application owners to plan updates or risk mitigation steps.

References

github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.