Vulnerabilities

CVSS

9.0 Critical

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk score

72.0

Published

2026-07-23

Status

Published

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Weaknesses

CWE-20CWE-502

Coverage 3

vulnerability

Unpatched Fastjson Vulnerability Exploited in Attacks

A critical remote code execution (RCE) vulnerability in Fastjson, a popular Java JSON processing library, has been actively exploited by threat actors. The vulnerability, tracked as CVE-2026-16723, allows attackers to ex…

SecurityWeek · Jul 28, 2026 Critical

CVE-2026-16723USSGCArcejsonspring boot

vulnerability

Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

A maximum-severity command injection vulnerability (CVE-2026-16812) in Arista VeloCloud Orchestrator (VCO) has been actively exploited in the wild, allowing remote code execution and potential access to VeloCloud Edge de…

The Hacker News · Jul 28, 2026 Critical

CVE-2026-16812CVE-2025-68686CVE-2026-16723command injectionvcocisa

vulnerability

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

A critical Remote Code Execution (RCE) vulnerability in Fastjson 1.x, a Java JSON library by Alibaba, is being actively exploited. Attackers are leveraging a type-resolution path to execute arbitrary code in Spring Boot…

The Hacker News · Jul 25, 2026 High

CVE-2026-16723USSGCArcejsonjava

All articles mentioning it

Advisories and references

• github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Exe...