# CVE-2026-16723: Alibaba fastjson remote code execution in Spring Boot fat-jar deployments

Source: https://junglewise.ai/threats/cve-2026-16723-alibaba-fastjson-remote-code-execution-in-spring-boot-fat-jar  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-08-07  
License: CC BY 4.0 with a link back

CVE-2026-16723 · Severity: critical · CVSS 9 · Published 2026-07-23

Alibaba fastjson, a widely used Java library for converting Java objects to JSON and vice versa, contains a critical security flaw. This vulnerability allows an attacker to remotely execute malicious code on the server hosting the application. The exploit is particularly dangerous because it works with the library's default settings, potentially leading to full system compromise, data theft, or service disruption.

Technologies: [com.alibaba:fastjson (Maven)](https://junglewise.ai/threats/technologies/com-alibaba-fastjson). Vendors: [Alibaba](https://junglewise.ai/threats/vendors/alibaba), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-16723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16723 being exploited in the wild.

**How severe is CVE-2026-16723?** Critical severity, with a CVSS score of 9, published 23 July 2026.

**Which products and versions are affected?** Alibaba Fastjson 1.2.68 - 1.2.83, 1.2.68 through 1.2.83; com.alibaba:fastjson (Maven) >= 1.2.68, <= 1.2.83, ECOSYSTEM:introduced=1.2.68,last_affected=1.2.83.

**Is there a fix for CVE-2026-16723?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16723 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16723?** Check whether you run Alibaba Fastjson or com.alibaba:fastjson (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution (RCE) vulnerability exists in Alibaba fastjson versions 1.2.68 through 1.2.83 due to improper input validation (CWE-20). The flaw is exploitable via the network without authentication, even in the library's stock default configuration where AutoType is not explicitly enabled. Unlike previous fastjson vulnerabilities, this exploit does not require a specific classpath gadget to achieve code execution. While the attack complexity is rated as High, a successful exploit results in a full scope change, allowing for complete compromise of confidentiality, integrity, and availability. No patched version for the 1.x branch is currently listed in the advisory; users are typically encouraged to migrate to fastjson2 or apply specific security workarounds provided by the vendor.

## Affected products

- Alibaba fastjson 1.2.68 - 1.2.83

## Identifiers

- CVE-2026-16723
- GHSA-crf3-v9rr-v7hj

## Timeline

- 2026-07-23: disclosed
- 2026-07-23: advisory
- 2026-08-07: other: Advisory updated

## References

- [https://api.github.com/users/dor-hayun](https://api.github.com/users/dor-hayun)
- [https://github.com/dor-hayun](https://github.com/dor-hayun)
- [https://api.github.com/users/dor-hayun/gists%7B/gist_id%7D](https://api.github.com/users/dor-hayun/gists%7B/gist_id%7D)
- [https://api.github.com/users/dor-hayun/repos](https://api.github.com/users/dor-hayun/repos)
- [https://avatars.githubusercontent.com/u/94103962?v=4](https://avatars.githubusercontent.com/u/94103962?v=4)
- [https://api.github.com/users/dor-hayun/events%7B/privacy%7D](https://api.github.com/users/dor-hayun/events%7B/privacy%7D)

## Related threats

- [Alibaba Fastjson remote code execution via autoType JNDI injection](https://junglewise.ai/threats/cve-2025-70974-alibaba-fastjson-remote-code-execution-via-autotype-jndi)
- [Unsafe deserialization in com.alibaba:fastjson](https://junglewise.ai/threats/cve-2022-25845-unsafe-deserialization-in-com-alibaba-fastjson)
- [Improper Input Validation in alilibaba:fastjson](https://junglewise.ai/threats/cve-2017-18349-improper-input-validation-in-alilibaba-fastjson)