CVE-2021-23758

Deserialization of Untrusted Data

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

Affected

AjaxPro.2

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SNYK

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

82.58% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-08-26

Published

2021-12-03

Updated

2026-08-27

Proof-of-concept exploits (1)

• numanturle/CVE-2021-23758-POC18★ · 2021-12-15

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ajaxpro_deserializa…

Security advisories

• https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agenti…
• michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
• https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
• advisories/GHSA-6r7c-6w96-8pvw

References

• CVE Record
• NVD entry

Related

• CVE-2021-41773
• CVE-2021-42008
• CVE-2021-43789
• CVE-2021-44228
• CVE-2022-0332
• CVE-2022-1388