Fastjson 1.x unauthenticated RCE in Spring Boot applications
Unauthenticated remote code execution in Alibaba's Fastjson 1.x JSON library via crafted JSON in Spring Boot apps. CVSS 9.0 (Alibaba-assigned). No patch available. Active exploitation confirmed by ThreatBook and Imperva.
- Vendor
- Alibaba
- Product
- Fastjson 1.x (Spring Boot applications)
- CVSS
- 9.0
- EPSS (exploit probability)
- 0.7%
- Status
- exploited-in-wild
- Published
Is CVE-2026-16723 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-16723 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.7% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-16723 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Unauthenticated remote code execution in Alibaba’s Fastjson 1.x JSON parsing library. Exploitation requires only that the application accept untrusted JSON input — no authentication, no user interaction.
Affected scope. Spring Boot applications running Fastjson 1.x that process JSON from untrusted sources (public API endpoints, user-submitted data, webhook handlers). A specially crafted JSON request triggers code execution with the privileges of the Java process.
Exploitation status. Active. ThreatBook and Imperva reported confirmed attack activity on July 25, 2026. Attribution: unconfirmed — treat accordingly. Not yet listed on CISA KEV at time of writing.
Patch status. None. Alibaba has not released a fix for the 1.x branch. No timeline is published.
Mitigation. Restrict or eliminate untrusted JSON deserialization at the application boundary. Consider migrating off Fastjson 1.x — the 1.x branch has a long history of deserialization vulnerabilities; Fastjson2, Jackson, and Gson are common alternatives.
Sources. NVD CVE-2026-16723 · The Hacker News, July 25, 2026
