Live › vulnerability › CVE-2021-23758
Go to dashboardAjax.NET Professional (AjaxPro), a .NET library for calling server methods from JavaScript, deserializes untrusted data and lets remote attackers instantiate arbitrary .NET classes. That gives an attacker remote code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Ajax.NET Professional Ajax.NET Professional | vendor | – | – |
| ajaxpro.2 project ajaxpro.2 | vendor | – | – |
| michaelschwarz ajax.net professional | vendor | < 21.10.30.1 | 21.10.30.1 |
Search your .NET solution and deployed bins for AjaxPro.dll or the Ajax.NET Professional package reference in .csproj/packages.config.
Discontinue use of Ajax.NET Professional and move to a supported AJAX or web API approach; the product is end-of-life and no fixed version is listed in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2021-23758")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.