ZeroDayAlert

CVE-2021-23758: Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

Ajax.NET Professional Ajax.NET Professional Added to KEV 2026-08-26 Federal due 2026-09-09 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Ajax.NET Professional (AjaxPro) is vulnerable to remote code execution through unsafe deserialization of untrusted data. The record indicates the product may be end-of-life or end-of-service, meaning vendor support and patches may be unavailable or limited. If your application uses this library—particularly in a web-facing context—you are at risk of arbitrary .NET code execution.

How to check whether this touches you

  • Search your codebase and dependency manifests for references to "Ajax.NET Professional", "AjaxPro", or the NuGet package Ajax.NET Professional.
  • Check whether any web endpoints accept serialised data (JSON, XML, or binary) from untrusted sources and pass it to AjaxPro deserialisation methods.
  • Confirm the installed version by examining the assembly version in bin/ or via your package manager; check vendor release notes or security advisories to determine whether your version is affected (version information is not specified in this record, so treat any pre-current build as a potential signal).
  • If the library is embedded in a third-party application you operate, contact the vendor to establish their patch or end-of-support status.

What to do

  1. Establish whether the vendor has released a patched version and the compatibility cost of upgrading. Given the end-of-life status flag, prepare for the possibility that no patch exists.
  2. If a patch is available, plan and execute the upgrade in accordance with CISA BOD 26-04 timelines and your risk classification.
  3. If no patch is available or upgrade is not feasible, restrict network access to any endpoint that handles untrusted serialised input: use firewall rules, IP whitelisting, or network segmentation to limit exposure to trusted clients only.
  4. If the library is unused or optional, remove it from your deployment.
  5. Enable detailed logging of deserialisation errors and exceptions; retain logs for at least 90 days to support forensic review if compromise is suspected.
  6. Escalate to your security team if the product is internet-facing, processes user input, or is critical to operations and no remediation path exists.

If you find you were exposed

Exploitation of deserialization flaws typically precedes public disclosure by months. If your asset was internet-facing before the CISA addition date of 26 August 2026, assume potential compromise from any date the library was deployed. Review web server and application logs covering at least the last 12 months for unusual POST/GET requests to AjaxPro endpoints, HTTP 500 errors during deserialisation, or execution of unexpected .NET processes. Engage forensics and threat-hunting teams if suspicious activity is detected; log retention constraints may limit visibility to the most recent weeks.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2021-23758 is being exploited. It cannot tell you whether Ajax.NET Professional is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →