CVE-2021-23758: ajaxpro.2_project ajaxpro.2, michaelschwarz ajax.net_professional

CVSS 9.8 (critical) · listed as exploited by CISA since 2026-08-26 · published 2021-12-03

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

Affected products (NVD): ajaxpro.2_project ajaxpro.2, michaelschwarz ajax.net_professional

Fixed in (NVD): 21.10.30.1

Weakness: CWE-502

Source: NVD CVE-2021-23758

References

• http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html
• https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
• https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
• http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html
• https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
• https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
• https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.