Deserialization of untrusted data in AjaxPro.2
Priority CRITICAL 100Exploited in the wildCWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
Why it matters now
Exploitation Active In CISA KEV since 2026-08-26CISA due date 2026-09-09
EPSS 0.82578 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed AjaxNetProfessional (NuGet): 21.11.29.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | AjaxPro.2 | all versions | — | No fix listed | CNA |
| — | AjaxNetProfessional (NuGet) | before 21.11.29.1 | 21.11.29.1 | Patch available | GHSA-6r7c-6w96-8pvw |
- AjaxPro.2 Vendor— Affected all versions Fixed in — No fix listed CNA
- AjaxNetProfessional (NuGet) Vendor— Affected before 21.11.29.1 Fixed in 21.11.29.1 Patch available GHSA-6r7c-6w96-8pvw
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ajaxpro.2_project:ajaxpro.2:*:*:*:*:*:.net:*:* | all versions | Vulnerable | Ajaxpro.2 Project |
| cpe:2.3:a:michaelschwarz:ajax.net_professional:*:*:*:*:*:.net:*:* | before 21.10.30.1 | Vulnerable | michaelschwarz |
- cpe:2.3:a:ajaxpro.2_project:ajaxpro.2:*:*:*:*:*:.net:*:* Versions all versions Vulnerable ·Ajaxpro.2 Project
- cpe:2.3:a:michaelschwarz:ajax.net_professional:*:*:*:*:*:.net:*:* Versions before 21.10.30.1 Vulnerable ·michaelschwarz
Remediation
- Fix · GHSA-6r7c-6w96-8pvw AjaxNetProfessional (NuGet) Fixed in 21.11.29.1 Advisory →
Timeline
- 2026-08-26 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-23758
- 2026-10-03 Alias added: GHSA-6r7c-6w96-8pvw
References
Exploit 2
Sources
- CVE-2021-23758 · CVE Program
- CVE-2021-23758 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-6r7c-6w96-8pvw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences