A Five-Year-Old Flaw Confirmed Under Active Attack
CISA has added CVE-2021-23758, a critical insecure deserialization vulnerability in Ajax.NET Professional (AjaxPro.2), to its Known Exploited Vulnerabilities (KEV) catalog. The bug has been public since 2021, but its KEV addition confirms attackers are actively exploiting it in the wild today — a reminder that old, unpatched dependencies remain a live attack surface long after disclosure.
The impacted library is flagged as end-of-life (EoL), meaning there is no vendor patch coming. CISA's guidance for EoL products in this situation is blunt: discontinue use or migrate off the product entirely.
Vulnerability Details
| Detail | Value |
|---|---|
| CVE | CVE-2021-23758 |
| CVSS Score | 9.8 (Critical) |
| Type | Deserialization of Untrusted Data (CWE-502) |
| Attack Vector | Network — unauthenticated |
| Affected Product | Ajax.NET Professional (AjaxPro.2), all versions before 21.10.30.1 |
| Status | End-of-life — no vendor fix planned |
| KEV Addition | August 26, 2026 |
How the Vulnerability Works
AjaxPro.2 is a .NET library that exposes AJAX-callable endpoints for legacy ASP.NET web applications. The library fails to implement a secure type binder or allowlist when deserializing incoming requests, so it does not restrict which .NET types can be instantiated from a serialized payload.
A remote, unauthenticated attacker can send a specially crafted serialized object to a vulnerable AjaxPro.2 endpoint. Because the deserializer trusts the type information embedded in that payload, the attacker can instantiate arbitrary .NET classes — including gadget chains that lead to full remote code execution with no authentication and no user interaction required.
Why This Matters Now
- No patch is coming. AjaxPro.2 is end-of-life; CISA's KEV entry explicitly notes affected products "could be" EoL and recommends discontinuing use.
- Unauthenticated, no user interaction. This is about as low-effort as RCE gets for an attacker who can reach the endpoint.
- Legacy exposure. AjaxPro.2 was widely bundled into older ASP.NET WebForms applications; many deployments may be running it without anyone on the current team aware it's there.
- Federal deadline applies. Per Binding Operational Directive requirements, Federal Civilian Executive Branch (FCEB) agencies running the affected library must remediate on CISA's published KEV timeline.
Remediation
There Is No Patch
Because the library is end-of-life, organizations cannot simply "update" their way out of this one. CISA's recommended path is:
- Discontinue use of AjaxPro.2 where possible, and migrate the application to a maintained AJAX/serialization framework.
- If discontinuation isn't immediately feasible, isolate the affected application behind strict network controls and a WAF rule set that blocks known AjaxPro deserialization payload patterns.
- Inventory your environment for legacy ASP.NET WebForms applications — AjaxPro.2 is easy to miss because it's often a transitive dependency pulled in years ago.
Detection
- Monitor for anomalous
.ashx/ AjaxPro endpoint requests carrying serialized.NETobject payloads. - Watch for unexpected child-process spawning from IIS worker processes hosting affected applications.
- Flag outbound connections initiated by web application processes that don't match normal application behavior.
Key Takeaways
- CVE-2021-23758 is a five-year-old bug just confirmed as actively exploited — KEV additions aren't limited to freshly disclosed CVEs.
- End-of-life software with no patch path forces a migrate-or-isolate decision rather than a simple update.
- Unauthenticated deserialization RCE remains one of the most dangerous vulnerability classes in the .NET ecosystem.
- Legacy dependency inventory matters — teams should audit for AjaxPro.2 even if it wasn't a deliberate recent choice.