Exploitation observed; activity peaked at 15 mentions and remains active
Immediate actions
Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVE-2026-16723: Remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration.
PoC
https://github.com/learner330/fastjson-cve-2026-16723 https://t.co/xpNpTn47ti
Post summary
The snippet announces a remote code execution vulnerability in fastjson 1.2.68‑1.2.83 and provides a link to PoC code on GitHub, with no patch or exploitation reports mentioned.
🚨 CVE-2026-16723: A critical FastJson RCE vulnerability is being actively exploited in the wild.
Public technical details and a PoC are now available.
🔗 https://github.com/dinosn/fastjson-jsontype-rce-lab
#FastJson#RCE#CVE#CyberSecurity https://t.co/jtbo8dLqLE
Post summary
CVE-2026-16723, a critical FastJson RCE, is already being exploited in the wild, with public technical details and a PoC available on GitHub.
Discover the critical Fastjson RCE CVE-2026-16723 vulnerability. Learn how attackers exploit Spring Boot applications and find mitigation strategies.
#Fastjson#CVE202616723#Cybersecurity#SpringBoot#Malware
http://meterpreter.org/fastjson-rce-cve-2026-16723/
Post summary
The post references a PoC and explains how Spring Boot applications can be exploited via the Fastjson RCE CVE‑2026‑16723, but it does not describe active attacks or specific patches.
FastJson RCE vulnerability CVE-2026-16723 is exploited in the wild. Details and PoC exploit code are public for this critical remote code execution flaw.
#FastJson#CVE202616723#RCE#ZeroDay
http://securityonline.info/fastjson-rce-cve-2026-16723/
Post summary
CVE-2026-16723 is actively exploited in the wild, with publicly available PoC exploit code and detailed RCE information.
The snippet points to a GitHub repository that likely hosts a proof‑of‑concept or exploit code for CVE‑2026‑16723, with no other contextual information about active attacks, patches, or technical details.
🚨 CVE-of-the-Day: CVE-2026-16723 — Fastjson (Java), unauth RCE
CVSS: 9.0 | EPSS: 0.66%
A malicious JSON request triggers code execution under Fastjson's default settings — no AutoType flag, no gadget class needed. Actively exploited, and there's no patch.
Why it matters: Fastjson is one of the most widely used JSON libraries in Java, sitting inside countless Spring Boot backends across banking, healthcare, and e-commerce. This bug runs with the same privileges as the Java process — reaching whatever backend it's parsing JSON for.
Status: Actively exploited, mostly targeting US organizations. Disclosed July 21 by FearsOff Cybersecurity via Alibaba's advisory. Fastjson 1.x is end-of-life — Alibaba has stated they will NOT patch this branch, only Fastjson 2.x going forward.
Fix it: Enable SafeMode now (-Dfastjson.parser.safeMode=true) as an immediate stopgap. Then plan migration to Fastjson 2.x, which isn't affected by design — it's not a drop-in replacement, so budget time for compatibility testing.
🔗 Source: Alibaba/Fastjson Security Advisory
#Java#AppSec#CVE#infosec#nopatch#exploited
Post summary
The tweet highlights CVE-2026-16723, an unauthenticated RCE in Fastjson 1.x that is actively exploited with no patch, and recommends enabling SafeMode and migrating to Fastjson 2.x as mitigations.
Netomize shares the PacketSmith Yara detection module rule and a pcap to detect attempts to exploit CVE-2026-16723 in the FastJson Java library.
This vulnerability was exploited in the wild, and public PoCs are already available.
@FearsOff
https://github.com/Netomize/RFiles/tree/main/cve_2026_16723 https://t.co/QXQlOAFkWI
Post summary
The tweet confirms that CVE-2026-16723 was actively exploited in the wild and that public PoCs are available, though no patch or technical detail is provided.
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — July 27, 2026
1️⃣ CERTIGHOST EXPLOIT GOES PUBLIC — ACTIVE DOMAIN COMPROMISE IN YOUR REACH
A proof-of-concept for CVE-2026-54121, dubbed "Certighost," has been made public. The vulnerability allows a standard Active Directory user to impersonate a Domain Controller, execute DCSync attacks, and extract the krbtgt account hash — effectively handing the attacker full domain control. Microsoft patched this on July 14, but any organization lagging on updates needs to move on Active Directory Certificate Services immediately.
🔹 @JNitterauer
2️⃣ GITLAB RCE PROOF-OF-CONCEPT DROPPED — SELF-MANAGED INSTANCES AT RISK
A researcher published a working exploit targeting self-managed GitLab 18.11.3 instances. Any authenticated user capable of pushing code can escalate to arbitrary command execution running as the git user. GitLab released a fix on June 10 as a routine bug fix with no CVE assigned, meaning many automated vulnerability scanners may have missed it entirely. Self-hosted admins should patch now.
🔹 @JNitterauer
3️⃣ FASTJSON RCE UNDER ACTIVE ATTACK — NO PATCH AVAILABLE YET
CVE-2026-16723 (CVSS 9.0) in Fastjson 1.x is being exploited in the wild with no official patch available. A single unauthenticated JSON request is enough to achieve remote code execution on Spring Boot applications using default settings. The recommended immediate mitigation is to enable SafeMode to block deserialization of dangerous types while waiting for an upstream fix.
🔹 @JNitterauer
4️⃣ CISA IDENTIFIES FSB CENTER 16 — DECADE-LONG CAMPAIGN AGAINST CRITICAL INFRASTRUCTURE
CISA officially attributed a persistent threat campaign to FSB Center 16, operating under the aliases Berserk Bear and Energetic Bear. For over a decade, the group has targeted poorly configured routers across the Communications, Energy, and Financial Services sectors. Notably, the campaign doesn't rely on zero-days — attackers exploit default credentials and flat network architectures, making remediation a configuration issue rather than a patching one.
🔹 @johnmcclure00
5️⃣ VATICAN APP EXPOSES 700,000 USERS' DATA FOR SIX MONTHS
A major security flaw in the Vatican's "Click to Pray" mobile application left personal data of over 700,000 users exposed for approximately six months before being discovered. The incident highlights that even organizations handling highly sensitive religious and personal information are not immune to basic security oversights in their digital platforms.
🔹 @dailytechonx
6️⃣ ELDER SCROLLS: MORROWIND NOW PLAYABLE IN-BROWSER VIA OPEN-SOURCE PROJECT
Thanks to an open-source initiative and a clever developer, The Elder Scrolls: Morrowind is now fully playable directly in a web browser. The project demonstrates the continued power of community-driven reverse-engineering and open-source development, breathing new life into a 2002 classic and making it accessible without any local installation.
🔹 @digitalfoundry
7️⃣ OPEN-SOURCE 3D-PRINTED PORTABLE MRI BUILT FOR UNDER $70,000
An open-source project has successfully built a portable MRI machine using 3D-printed components at a cost under $70,000 — a fraction of the $3-7 million price tag of traditional systems. The achievement, shared on Hacker News and Tom's Hardware, demonstrates how open-source hardware initiatives can dramatically reduce the cost of medical imaging equipment and expand access to underserved regions.
🔹 @betterhn20
💭 The week's cybersecurity landscape is dominated by a trio of critical vulnerabilities now under active exploitation — from Active Directory to GitLab to Fastjson. What ties them together is the race condition between disclosure and remediation: some have patches that organizations haven't applied, while others have no fix at all. Meanwhile, the CISA attribution of FSB Center 16 reminds us that not all effective attacks need fancy exploits — bad configuration management remains one of the most reliable attack vectors. On a brighter note, open-source communities continue to push boundaries, from browser-based gaming to democratizing medical imaging.
Which of these vulnerabilities should your organization prioritize patching first this week? 👇
#Cybersecurity#OpenSource#InfoSec#CVE#VulnerabilityResearch
Post summary
The post highlights three vulnerabilities currently exploited—Fastjson without a patch, Certighost and GitLab with pending updates—underscoring the urgency for timely patches and configuration hardening.
A critical Fastjson RCE is under active exploitation.
CVE-2026-16723 affects Fastjson 1.2.68–1.2.83 and can be exploited under the stock default configuration without authentication or AutoType being enabled.
Read here: https://www.sequretek.com/resources/threat-advisories/Critical%20Remote%20Code%20Execution%20Vulnerability%20in%20Fastjson
#CyberSecurity#Fastjson#RCE https://t.co/t0O8fLd4ws
Post summary
The tweet announces that CVE-2026-16723 in Fastjson is actively being exploited in the wild, providing affected versions and exploitation conditions, but it does not mention a patch, PoC, or exploitation tool.
JumpServer is affected by CVE-2026-16723 (fastjson RCE, CVSS 9.0) via our Chen component.
Fixed in:
→ v3.10.22 LTS (V3)
→ v4.10.17 LTS (V4)
fastjson dependency removed entirely. Advisory:
http://jumpserver.com/blog/jumpserver-vulnerability-advisory-2026-7-29
If you run JumpServer, upgrade now. No auth needed to exploit.
#CVE202616723#JumpServer#CyberSecurity
Post summary
An advisory for JumpServer informs of CVE‑2026‑16723, a fastjson RCE requiring no authentication, and provides patch versions and an upgrade recommendation.
Investigadores de Hispasec alertan sobre la vulnerabilidad crítica CVE-2026-16723 en Fastjson 1.x, que permite ejecución remota de código sin autenticación. Equipos de seguridad deben activar SafeMode o migrar a fastjson2 para mitigar el riesgo.
https://unaaldia.hispasec.com/un-zero-day-critico-en-fastjson-abre-la-puerta-a-ataques-remotos-en-servidores-java/?utm_source=rss&utm_medium=rss&utm_campaign=un-zero-day-critico-en-fastjson-abre-la-puerta-a-ataques-remotos-en-servidores-java https://t.co/RISOvVXZGx
Post summary
Hispasec alerts about a critical unauthenticated RCE in Fastjson 1.x (CVE‑2026‑16723) and advises enabling SafeMode or migrating to Fastjson2 to mitigate the risk.
FastJson RCE Zero-Day Actively Targets Organizations | eSecurity Planet https://www.esecurityplanet.com/threats/fastjson-rce-zero-day-actively-targets-organizations/
"CVE-2026-16723, stems from FastJson’s type-resolution logic, which performs attacker-controlled resource lookups before enforcing its AutoType security restrictions."
Post summary
FastJSON RCE (CVE‑2026‑16723) is reported as actively exploited via attacker‑controlled type‑resolution logic, with no PoC, exploit tool, patch, or false‑positive claim referenced.
Vulnerabilidad crítica CVE-2026-16723 en FastJson.
Más información: https://csirt.telconet.net/comunicacion/boletines-servicios/vulnerabilidad-critica-cve-2026-16723-en-fastjson/ https://t.co/kF1Tsm4Clr
Post summary
The tweet announces a critical vulnerability (CVE-2026-16723) in FastJson and directs readers to external links for details, but provides no technical specifics, PoC, exploit, or patch information.
Vulnerability Alert: CVE-2026-16723
Attackers are actively targeting a critical remote code execution (RCE) vulnerability affecting Alibaba Fastjson 1.x.
The vulnerability impacts Fastjson versions 1.2.68–1.2.83 running in vulnerable Spring Boot fat-JAR applications and can allow unauthenticated remote code execution. There is currently no official patch available for Fastjson 1.x.
Key Details:
• CVE-2026-16723 (CVSS 9.0 – Critical)
• Active exploitation observed in the wild
• Fastjson 1.2.68–1.2.83 affected
• No authentication required for exploitation under vulnerable conditions
Recommended Actions:
• Enable Fastjson SafeMode (-Dfastjson.parser.safeMode=true)
• Inventory direct and transitive Fastjson dependencies
• Monitor for indicators of compromise, including suspicious @type values and unexpected outbound connections
• Plan migration to Fastjson2, which is not affected
Organizations using Java and Spring Boot applications should assess their exposure and implement mitigations as soon as possible.
#CyberSecurity#VulnerabilityAlert#ApplicationSecurity#Java#SpringBoot#ThreatIntelligence#CVE202616723#CloneSystems
Post summary
The post highlights that CVE-2026-16723 is being actively exploited for unauthenticated RCE in Fastjson 1.x, with no patch yet and recommended mitigations.
A critical Fastjson vulnerability allows unauthenticated code execution in Spring Boot apps. No patch for 1.x exists yet. Here is how to protect your systems now.
For More: https://www.redsecuretech.co.uk/blog/post/fastjson-vulnerability-cve-2026-16723-what-you-must-know/1349
#Fastjson#CVE#JavaSecurity#SpringBoot#RCE#Alibaba#Cybersecurity#InfoSec https://t.co/G1yw0pHjRY
Post summary
The post highlights a critical Fastjson flaw that permits unauthenticated code execution in Spring Boot apps, notes no current patch for 1.x, and directs readers toward mitigation steps rather than presenting exploits or active attacks.
