{"id":"CVE-2021-23758","kind":"vulnerability","aliases":["CVE-2021-23758"],"related":[],"title":"All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of…","description":"Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Ajax.NET Professional (AjaxPro), a .NET library for calling server methods from JavaScript, deserializes untrusted data and lets remote attackers instantiate arbitrary .NET classes. That gives an attacker remote code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-08-26T00:00:00+00:00","products":[{"name":"Ajax.NET Professional Ajax.NET Professional","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ajaxpro.2 project ajaxpro.2","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"michaelschwarz ajax.net professional","fixed":["21.10.30.1"],"affected":"< 21.10.30.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ajax.net-professional","asp.net","dotnet","exploited","package"],"not_affected_if":["not-using-ajaxpro"],"how_to_check":"Search your .NET solution and deployed bins for AjaxPro.dll or the Ajax.NET Professional package reference in .csproj/packages.config.","fix":"Discontinue use of Ajax.NET Professional and move to a supported AJAX or web API approach; the product is end-of-life and no fixed version is listed in the sources.","status":"open","published_at":"2021-12-03T20:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:49+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:31:49Z","model":"claude-haiku-5-5","output":{"fix":"Discontinue use of Ajax.NET Professional and move to a supported AJAX or web API approach; the product is end-of-life and no fixed version is listed in the sources.\nunknown","summary":"Ajax.NET Professional (AjaxPro), a .NET library for calling server methods from JavaScript, deserializes untrusted data and lets remote attackers instantiate arbitrary .NET classes. That gives an attacker remote code execution on the server.","category":"package","who_cares":["dotnet","asp.net","ajax.net-professional"],"confidence":0.8,"analyst_note":"Confirm the affected version range and whether any vendor mitigation exists; see the CISA KEV entry https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-23758.","how_to_check":"Search your .NET solution and deployed bins for AjaxPro.dll or the Ajax.NET Professional package reference in .csproj/packages.config.\nunknown","needs_analyst":true,"not_affected_if":["not-using-ajaxpro"],"severity_if_unknown":"critical"},"cost_usd":0.000426,"input_tokens":2283,"output_tokens":395,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':139C,165C,196C '-2021':18A,21A '-23758':19A,22A '26':138C,164C,195C 'accord':128C 'action':124C 'adher':192C 'advis':112C 'ajax.net':23A,25A,31A,33B,39B,72C 'ajaxpro':41B,74C 'ajaxpro.2':5A,27A,29A 'allow':84C 'and/or':104C,116C 'appli':125C 'applic':162C 'arbitrari':59B,90C 'asp.net':35B 'asset':186C 'attack':57B,65B 'base':143C 'bod':137C,163C,194C 'call':46B 'cisa':122C,135C,152C 'class':61B,92C 'cloud':168C 'code':67B,87C 'complianc':133C 'contain':75C 'could':83C,97C 'cve':17A,20A 'data':12A,53B,80C 'deseri':9A,51B,77C 'discontinu':114C,171C 'dotnet':36B 'due':13A 'end':100C,106C 'end-of-lif':99C 'end-of-servic':105C 'ensur':132C,191C 'eo':109C 'eol':103C 'evalu':184C 'execut':68B,88C 'exploit':37B 'exposur':189C 'follow':161C 'forens':154C 'give':63B 'guidanc':150C,166C 'guidelin':198C 'impact':94C 'instanti':58B 'instruct':131C 'internet':188C 'javascript':50B 'let':55B 'librari':44B 'life':102C 'method':48B 'michaelschwarz':30A 'mitig':126C,177C 'net':43B,60B,91C 'note':149C,160C 'packag':4A,38B 'patch':197C 'possibl':16A 'priorit':140C 'product':95C,175C 'profession':34B,40B,73C 'professional':24A,26A,32A 'project':28A 'remot':56B,66B,86C 'requir':123C,156C 'respons':182C 'risk':145C 'secur':141C 'see':146C,157C 'server':47B,71B 'servic':108C,169C 'stakehold':180C 'support':120C 'transit':117C 'triag':155C 'unavail':179C 'untrust':11A,52B,79C 'updat':142C 'url':147C,158C 'use':115C,172C 'user':110C 'vendor':130C 'version':2A,121C 'via':89C 'vulner':7A,81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-12-03T20:15:07+00:00","kev":{"dateAdded":"2026-08-26","dueDate":"2026-09-09","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"report@snyk.io","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-23758","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-23758","severity":null,"published_at":"2026-08-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-23758","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23758","severity":null,"published_at":"2021-12-03T20:15:07+00:00","modified_at":"2026-08-27T04:16:38+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}