Summary
generated automatically from NVD dataCVE-2021-23758 affects all versions of the ajaxpro.2 package (Ajax.NET Professional), which deserializes untrusted data (CWE-502). Because arbitrary .NET classes can be deserialized, an attacker can abuse this to achieve remote code execution. It is rated HIGH with a CVSS v3.1 score of 8.1, and it is listed in the CISA KEV catalog, which indicates active exploitation.
NVD description
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-09-09
EPSS · FIRST.org
82.6%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 3 déc. 2021
- Updated
- 27 août 2026
- Status
- Analyzed
- Source
- report@snyk.io
Affected products
Weaknesses (CWE)
References (8)
- https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971Third Party Advisory
- https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-502
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.