CVE-2021-23758 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2021-12-03

Added to CISA KEV: 2026-08-26 1727 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review IIS/web server logs for suspicious POST requests to AjaxPro .ashx handlers, look for web shells, unexpected child processes of the w3wp.exe worker process, and unauthorized outbound connections.
Immediately upgrade AjaxPro to version 21.11.29.1 or later; because the library is EoL/EoS, strongly prefer removing AjaxPro entirely and migrating to a modern, supported framework.
If immediate patching is not possible, block or restrict access to AjaxPro handler endpoints (e.g., *.ashx AjaxPro routes) at the WAF/reverse proxy and monitor for exploitation attempts using known Metasploit/PoC signatures.
Patch priority: URGENT/EMERGENCY — unauthenticated RCE on internet-facing web servers, actively exploited, in CISA KEV. Remediate per CISA KEV due-date guidance immediately.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2021-23758 is a critical insecure deserialization vulnerability affecting all versions of the Ajax.NET Professional (AjaxPro) library, specifically the `AjaxPro.2` package for Microsoft ASP.NET ^[2]^[7]. The vulnerability arises because the framework can be manipulated to deserialize arbitrary .NET classes from untrusted input, which matters significantly because it allows unauthenticated remote attackers to execute arbitrary code on the underlying web server ^[1]^[5].

Exploitation

Active Exploitation: The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming that it is actively exploited in the wild ^[1].
PoC/Exploit Availability: Public proof-of-concept code and exploit modules exist, including a module for the Metasploit Framework, making it relatively straightforward for attackers to weaponize ^[3]^[8].
Attack Prerequisites: This is a network-based attack that does not require local access or user interaction. Furthermore, it can be executed by an unauthenticated attacker, meaning no credentials are required to compromise the system ^[1]^[2].

Affected Products & Patches

Affected Versions: All versions of the `AjaxPro.2` package are vulnerable ^[7].
Patches: A fix was released in version `21.11.29.1` ^[1].
Mitigations: Because the library is often considered end-of-life (EoL) or end-of-service (EoS) in many deployments, security advisories often recommend discontinuing use of the library entirely or transitioning to a modern, supported alternative rather than relying solely on patching ^[4].

Impact

System Access: Successful exploitation grants the attacker remote code execution (RCE) capabilities, allowing them to run arbitrary commands on the server within the context of the user running the web application ^[3].
Business Risk: For internet-facing deployments, the risk is critical (CVSS 9.5–9.8) as it provides a direct path for attackers to gain full control of the web server, potentially leading to data breaches, installation of ransomware, lateral movement within the network, or complete service compromise ^[1]^[6].

Sources

CVE-2021-23758 · Ajax.NET Professional · CVSS 9.5 · CISA KEV · CVE ...
CVE-2021-23758 9.5 CISA KEV Ajax.NET Professional · AjaxPro.2 Ajax.NET Professional is vulnerable to deserialization of untrusted data, which can be exploited by unauthenticated attackers to achieve remote code execution. Quick facts CVSS score 9.5 (Critical) CISA KEV Listed (confirmed active exploi…
CVE-2021-23758: Ajaxpro.2 RCE Vulnerability - SentinelOne
CVE-2021-23758 Overview CVE-2021-23758 is a critical insecure deserialization vulnerability affecting all versions of the AjaxPro.2 package for .NET. The vulnerability allows remote attackers to execute arbitrary code on affected systems by exploiting the deserialization of untrusted data. ... CVE-2…
AjaxPro Deserialization Remote Code Execution
This module leverages an insecure deserialization of data to get remote code execution on the target OS in the context of the user running the website which ...
CVE-2021-23758 — Ajax.NET Professional Deserialization of Untrusted ...
What happened Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product (s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or…
CVE-2021-23758
Common vulnerabilities and Exposures (CVE). We're sorry but the CVE Website doesn't work properly without JavaScript enabled. Please enable it to continue. ... Vulnerability detail for CVE-2021-23758 Description All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data du…

🔴 CVE-2021-23758