CVE-2026-16723 is an unauthenticated RCE vulnerability in Fastjson 1.2.68–1.2.83 that works under default configuration when deployed as a Spring Boot fat-JAR. No patch exists yet. The exploit abuses a @type field with a @JSONType annotation to trigger a class-resource lookup inside the nested JAR structure, bypassing type checks. Active exploitation has been confirmed by ThreatBook and Imperva. Mitigation involves enabling SafeMode via a JVM flag (-Dfastjson.parser.safeMode=true) or switching to the noneautotype build. Teams should audit transitive dependencies using mvn dependency:tree, check logs for unexpected @type payloads, and treat migration to Fastjson2 as planned work. Internal services are also at risk if an attacker gains any foothold.
