CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCE

Checked: 2026-10-29

CVE-2021-23758 is an insecure-deserialization vulnerability in Ajax.NET Professional (AjaxPro), an older open-source .NET AJAX library: because the JSON deserializer could instantiate arbitrary .NET classes from attacker-controlled input with no type restriction, a remote attacker could achieve code execution on any application still using it, and CISA added it to the KEV catalog in 2026 explicitly because the project is end-of-life.

Vulnerability summary

Vulnerability ID	CVE-2021-23758
CVSS score	9.8
EPSS score	0.8258
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD
Published	2021-12-03T20:15:07.557

Affected components

Component	CPE	Version range
Ajax.NET Professional (AjaxPro) / ajaxpro.2 package	cpe:2.3:a:michaelschwarz:ajax.net_professional::::::.net::*	Ajax.NET Professional before 21.10.30.1; all published NuGet releases of ajaxpro.2 (2.9.17.2, 6.10.6.2 — no fixed version recorded)

What this means

CVE-2021-23758 is a deserialization-of-untrusted-data vulnerability (CWE-502) affecting Ajax.NET Professional (also distributed as the ajaxpro.2 NuGet package), an open-source library for calling .NET server methods from client-side JavaScript that was popular in mid-2000s/2010s ASP.NET applications. NVD's description states: "All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution" (NVD).

NVD's own analysis gives CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction, full compromise. The original reporter (Snyk) submitted a lower CNA Secondary score of 8.1; NVD's own Primary v3.1 score is the higher 9.8 (NVD).

The upstream michaelschwarz/Ajax.NET-Professional repository's fix, commit b0e63be5, adds configurable type allow-/deny-lists to the JSON deserializer (AjaxSettingsSectionHandler.cs and JavaScriptDeserializer.cs): once a jsonDeserializationCustomTypes whitelist is configured, only explicitly allowed types can be instantiated during deserialization, and attempting to instantiate a disallowed type throws a SecurityException. This is the mechanism fixed in Ajax.NET Professional 21.10.30.1; the NVD CPE match also lists the separate ajaxpro.2_project:ajaxpro.2 package as vulnerable with no fixed version recorded (Ajax.NET Professional fix commit b0e63be5).

CISA added CVE-2021-23758 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-26 (catalog version 2026.10.28, 1762 entries, confirmed live this run), with a required-action due date of 2026-09-09 and a note that "the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS)" — CISA's standard language advising affected organizations to discontinue use rather than expect an ongoing vendor patch stream. The catalog does not record known ransomware-campaign use (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.8258 (99.663rd percentile), a very high figure consistent with years of opportunistic internet-wide scanning for this library's deserialization endpoint rather than a single targeted campaign (FIRST EPSS).

Because the AjaxPro project is effectively unmaintained, organizations that find it in a legacy ASP.NET application should treat remediation as removal/replacement rather than patching: either upgrade to a build with the type-restriction fix and configure a strict allow-list, or discontinue the library entirely in favor of a maintained alternative.

How to fix this class of issueThis advisory's weakness class is Insecure deserialization. Our practical guide covers how to detect, fix, verify and disclose it: How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware.

Evidence

Ajax.NET Professional (ajaxpro.2) deserializes untrusted JSON input without restricting which .NET classes can be instantiated, allowing remote code execution. — NVD
NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; the original reporter's CNA Secondary score was 8.1. — NVD
Fix commit b0e63be5 adds a configurable allow-/deny-list for deserialized types, blocking instantiation of disallowed types; fixed in Ajax.NET Professional 21.10.30.1. — Ajax.NET Professional fix commit b0e63be5
Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-26, required-action due date 2026-09-09, flagged as possibly end-of-life/end-of-service (catalog version 2026.10.28, 1762 entries, confirmed live this run). — CISA KEV
EPSS score is 0.8258 (99.663rd percentile) as of 2026-10-28. — FIRST EPSS
The ajaxpro.2 NuGet package has published releases 2.9.17.2 and 6.10.6.2, with no fixed version listed. — NuGet Gallery

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2025-62593: Ray AI Compute Engine Browser-to-RCE via DNS Rebinding (KEV)CVE-2025-62593: KEV code injection in Ray lets an attacker combine DNS rebinding with a Firefox/Safari User-Agent spoof to reach a developer's local Ray dashboard and run arbitrary code. Sourced to NVD, CISA and Ray-Project.CVE-2025-6965: SQLite Aggregate-Term Truncation Reaches Siemens RUGGEDCOM CROSSBOW SACCVE-2025-6965: an integer truncation in SQLite before 3.50.2 corrupts memory when aggregate terms exceed available columns; Siemens ships the vulnerable engine inside RUGGEDCOM CROSSBOW SAC. NVD-scored 7.7, sourced to NVD, CISA ICS and Siemens.