Deserialization of untrusted data in Ajax.NET Professional enables unauthenticated RCE on ASP.NET servers (CVE-2021-23758)
CISA added this CVE to KEV yesterday on the heels of Cisco Talos reporting UAT-10147 exploiting AjaxPro-based web servers globally, so teams still shipping the library remain exposed to an active campaign.
Ajax.NET Professional (AjaxPro), a legacy AJAX library used in older ASP.NET applications, deserializes attacker-controlled data into arbitrary .NET classes, allowing an unauthenticated remote attacker to execute code on the web server. Many deployments embed the library indirectly and may be end-of-life.
Affected: Ajax.NET Professional (AjaxPro.2), versions prior to the fixed release
How to Test
Inventory ASP.NET applications for the AjaxPro.2 assembly in application bin directories and for AjaxPro handler registrations in web.config; review IIS logs for unexpected POST requests to AjaxPro handler endpoints on internet-facing apps.
How to Patch
Upgrade to an Ajax.NET Professional build containing fix commit b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 from the michaelschwarz/Ajax.NET-Professional repository; if the embedding application is end-of-life, remove the library or discontinue the product. CISA requires federal agencies to remediate by 2026-09-09.