CVE-2021-23758: Ajax.NET Professional ajaxpro.2 untrusted deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with a 9.8 CVSS score, KEV listing and very high EPSS probability makes this an urgent patch-first item.

What it is

All versions of the ajaxpro.2 package (Ajax.NET Professional) deserialize untrusted data and permit deserialization of arbitrary .NET classes. That lets an attacker craft a malicious payload that executes code on the server. The flaw is remotely reachable without authentication, so any exposed instance is a serious risk.

Impact

An unauthenticated attacker can achieve remote code execution in the context of the web application, leading to full compromise of the host and any data or credentials it can reach.

Attack surface

Reached over the network via the Ajax.NET HTTP endpoint that processes serialized requests; the CVSS vector shows no privileges and no user interaction required. Any internet- or network-exposed deployment of the package is in scope.

Exploitation

CISA added it to KEV with a 2026-09-09 remediation due date, and public exploit code exists (Packet Storm, Talos blog reference). EPSS is 0.83633 (99.7th percentile), indicating very high likelihood of exploitation activity.

What to do

• Apply the vendor patch from the Ajax.NET Professional commit b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 or upgrade to a fixed release.
• If no fixed version is available for your deployment, remove or disable the ajaxpro.2 handler and discontinue use of the product per CISA BOD 26-04 guidance.
• Restrict network access to Ajax.NET endpoints so only trusted clients can reach them; do not expose them to the internet.
• Enforce .NET deserialization protections (type allow-listing, disabling unsafe binders) where the framework permits.
• Inventory all applications referencing ajaxpro.2 or Ajax.NET Professional and prioritize internet-facing instances for immediate remediation.

Detection

• Search web/proxy logs for POST requests to Ajax.NET handler paths with unusually large or binary-looking bodies.
• Monitor for w3wp.exe or the application process spawning child processes such as cmd.exe, powershell.exe or net.exe.
• Look for .NET deserialization gadget artifacts or known ysoserial.net payload markers in request bodies.
• Alert on outbound connections from web servers to new or unusual destinations following Ajax endpoint traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.