Threat video1:00
CVE-2026-16723 Gadget-Free Fastjson RCE: Detection & IOCs
Attackers reach RCE in Fastjson 1.2.68-1.2.83 with AutoType off and no gadget; 7 IOCs and 9 detection rules cover it, including a free Splunk SPL rule.
Read the full threat intel for CVE-2026-16723 Gadget-Free Fastjson RCE: Detection & IOCs →
Chapters
- 0:00The hookResearchers reproduced unauthenticated Fastjson RCE.
- 0:04The storyIn July researchers reproduced critical Fastjson RCE.
- 0:12Attack pathIn the lab, researchers reproduced the @type parsing flaw.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromise4 indicators to hunt: 1 file name, 1 path and 2 package names.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from reconnaissance to stealth.
- 0:42Remediation5 steps now: Enable Fastjson SafeMode.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Researchers reproduced unauthenticated Fastjson RCE.
0:05In July researchers reproduced critical Fastjson RCE.
0:09The flaw: standalone exploit.
0:13In the lab, researchers reproduced the @type parsing flaw.
0:16Attackers send crafted JSON to trigger remote fetch.
0:20The class loads and executes code.
0:26No threat actor: this was defensive research.
0:314 indicators to hunt: 1 file name, 1 path and 2 package names.
0:386 ATT&CK techniques, from reconnaissance to stealth.
0:435 steps now: Enable Fastjson SafeMode.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.