CVE-2021-23758

critical

Description

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

References

https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971

https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57

https://securityaffairs.com/197975/hacking/u-s-cisa-adds-red-hat-linux-kernel-ajax-net-professional-microsoft-sql-server-and-citrix-netscaler-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.infosecurity-magazine.com/news/cisa-kev-microsoft-citrix/

https://www.helpnetsecurity.com/2026/08/27/netscaler-adc-gateway-cve-2026-8452/

https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html

https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog

https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html

https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/

https://github.com/advisories/GHSA-74r6-grj9-8rq6

https://github.com/advisories/GHSA-6r7c-6w96-8pvw

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2466

http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html

Details

Source: Mitre, NVD

Published: 2021-12-03

Updated: 2026-08-27

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.82578

Detections

Analytics