What’s Vulnerable › Vulnerabilities

CVE-2021-23758: Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-08-26
• EPSS: 82.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-03 · updated 2026-08-27
• Weakness: CWE-502

Description

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

Affected products

• Ajaxpro.2 Project Ajaxpro.2: all versions
• michaelschwarz Ajax.Net Professional: before 21.10.30.1 — fixed in 21.10.30.1

How to fix

Upgrade to a fixed version: michaelschwarz Ajax.Net Professional 21.10.30.1. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html
• https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
• https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
• http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html
• https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
• https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
• https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758

Get alerted when CVE-2021-23758 or the next vulnerability affects your stack