CVE-2026-16723 is a remote code execution vulnerability in Alibaba Fastjson versions 1.2.68 through 1.2.83, specifically confirmed in version 1.2.68. The vulnerability stems from improper input validation (CWE-20) and relates to unsafe deserialization (CWE-502). It can be exploited remotely without needing AutoType enabled or classpath gadgets, under Fastjson's default configuration. The CVSS 3.1 base score is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting critical severity with high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems running Fastjson 1.2.68, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability at a high level, as indicated by the CVSS score. Since exploitation does not require enabling AutoType or classpath gadgets, the attack surface is broader under default configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations recommended by Alibaba or avoid using the affected version 1.2.68. Monitor Alibaba's official channels for updates and patches addressing this vulnerability.