CVE Details

CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Published: 2026-08-26 CVSS: 8.1 HIGH Product: Ajax.NET Professional Ajax.NET Professional Due Date: 2026-09-09

Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 8.1
  • Severity: HIGH
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > state PUBLISHED
cveMetadata > cveId CVE-2021-23758
cveMetadata > assignerOrgId bae035ff-b466-4ff4-94d0-fc9efd9e1730
cveMetadata > assignerShortName snyk
cveMetadata > dateUpdated 2026-08-26T17:44:58.213Z
cveMetadata > dateReserved 2021-01-08T00:00:00.000Z
cveMetadata > datePublished 2021-12-03T20:05:12.932Z
containers > cna > title Deserialization of Untrusted Data
containers > cna > datePublic 2021-12-03T00:00:00.000Z
containers > cna > providerMetadata > orgId bae035ff-b466-4ff4-94d0-fc9efd9e1730
containers > cna > providerMetadata > shortName snyk
containers > cna > providerMetadata > dateUpdated 2023-11-14T03:06:35.776Z
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
containers > cna > affected > 0 > vendor n/a
containers > cna > affected > 0 > product AjaxPro.2
containers > cna > affected > 0 > versions > 0 > version 0
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > lessThan unspecified
containers > cna > affected > 0 > versions > 0 > versionType custom
containers > cna > references > 0 > url https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
containers > cna > references > 1 > url https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
containers > cna > references > 2 > url http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html
containers > cna > credits > 0 > lang en
containers > cna > credits > 0 > value Hans-Martin Münch (MOGWAI LABS)
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity HIGH
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > baseScore 8.1
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity HIGH
containers > cna > problemTypes > 0 > descriptions > 0 > type text
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > description Deserialization of Untrusted Data
containers > adp > 0 > providerMetadata > orgId af854a3a-2127-422b-91ae-364da2661108
containers > adp > 0 > providerMetadata > shortName CVE
containers > adp > 0 > providerMetadata > dateUpdated 2024-08-03T19:14:09.129Z
containers > adp > 0 > title CVE Program Container
containers > adp > 0 > references > 0 > url https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
containers > adp > 0 > references > 0 > tags > 0 x_transferred
containers > adp > 0 > references > 1 > url https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
containers > adp > 0 > references > 1 > tags > 0 x_transferred
containers > adp > 0 > references > 2 > url http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html
containers > adp > 0 > references > 2 > tags > 0 x_transferred
containers > adp > 1 > metrics > 0 > other > type ssvc
containers > adp > 1 > metrics > 0 > other > content > id CVE-2021-23758
containers > adp > 1 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 1 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 1 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 1 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 1 > metrics > 0 > other > content > version 2.0.3
containers > adp > 1 > metrics > 0 > other > content > timestamp 2026-08-26T17:44:04.350622Z
containers > adp > 1 > references > 0 > url https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
containers > adp > 1 > references > 0 > tags > 0 third-party-advisory
containers > adp > 1 > references > 1 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758
containers > adp > 1 > references > 1 > tags > 0 government-resource
containers > adp > 1 > problemTypes > 0 > descriptions > 0 > lang en
containers > adp > 1 > problemTypes > 0 > descriptions > 0 > type CWE
containers > adp > 1 > problemTypes > 0 > descriptions > 0 > cweId CWE-502
containers > adp > 1 > problemTypes > 0 > descriptions > 0 > description CWE-502 Deserialization of Untrusted Data
containers > adp > 1 > title CISA ADP Vulnrichment
containers > adp > 1 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 1 > providerMetadata > shortName CISA-ADP
containers > adp > 1 > providerMetadata > dateUpdated 2026-08-26T17:44:58.213Z