AjaxPro CVE-2021-23758: Old ASP.NET RCE Now in CISA KEV

What to do

1. Search source trees, build output and IIS servers for AjaxPro.2.dll, AjaxPro references in .csproj or packages.config, and ajaxpro/*.ashx handlers in web.config.
2. Replace AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro with the official AjaxNetProfessional package at 21.12.22.1 or later, then rebuild and redeploy.
3. Keep custom JSON deserialization types deny-by-default and allow only your own namespaces.
4. For vendor apps you cannot rebuild, restrict /ajaxpro/ to trusted networks, block AjaxPro.Services requests, and ask the vendor for a fixed build.
5. If an unpatched app was internet-facing, hunt for compromise and rotate secrets stored in its web.config.

How to check if you are affected or compromised

• Search IIS logs for POST requests to /ajaxpro/*.ashx, especially AjaxPro.Services classes, from unfamiliar sources.
• If you keep WAF or request-body logs, look for JSON bodies with __type keys naming system classes.
• Hunt for w3wp.exe spawning cmd.exe or powershell.exe, and for new .aspx or .ashx files in web roots.

What happened#

Ajax.NET Professional (AjaxPro) is one of the oldest AJAX frameworks for ASP.NET. It exposes server methods to the browser through an ajaxpro/*.ashx HTTP handler. CVE-2021-23758, published on December 3, 2021, covers its JSON deserializer. The deserializer trusted a client-supplied __type key and would build arbitrary .NET classes. MOGWAI LABS found the flaw during a penetration test and showed that common ysoserial.net gadgets turn it into remote code execution. The maintainer's fix makes custom deserialization types deny-by-default, and the project published GHSA-6r7c-6w96-8pvw. A public Metasploit module now automates the attack.

Nearly five years later, on August 26, 2026, CISA added the CVE to the KEV catalog and set a September 9 deadline for federal agencies. CISA's alert says only that the addition is "based on evidence of active exploitation". The entry lists ransomware use as unknown and notes the product could be end-of-life. As of October 21, 2026, no attacker, campaign or victim had been named publicly, and The Hacker News coverage adds none. NVD scores the flaw CVSS 3.1 9.8. The original CNA, Snyk, rates it 8.1 with high attack complexity.

Who is affected#

The library is .NET-only and mostly shows up in older ASP.NET Web Forms applications: intranet portals, line-of-business apps, and commercial products with .NET web front ends. It may sit in bin/ as a copied DLL rather than as a NuGet reference. Sources disagree on the exact first safe release:

• NVD's configuration data flags versions before 21.10.30.1. MOGWAI LABS says the fix landed in 21.11.11.1. The GitHub advisory lists 21.11.29.1 as patched.
• The Metasploit module notes that 21.10.30.1 removed the vulnerable default method but stays exploitable if the app exposes its own method that accepts an object parameter.
• The unofficial NuGet packages that many old projects reference, AjaxPro.2 (last release 6.10.6.2, in 2016), Joint.AjaxPro and JointAjax.AjaxPro, have no patched version listed in the maintainer's advisories.

The safe target is the official AjaxNetProfessional package at 21.12.22.1 or later. That release also fixes two later AjaxPro advisories. The current version is 24.10.10.1.

Do you really need to act?#

Most teams don't. If you build on ASP.NET Core, Java, Node or anything else that never pulled in AjaxPro, this entry is not about you. The risk is concentrated in forgotten legacy apps, the kind where nobody remembers the DLL is there. If you find AjaxPro on an internet-facing site, treat it as act-now. No login is needed, a ready-made exploit exists, and CISA has confirmed exploitation. On internal-only apps the urgency is lower, but this is still code execution as the IIS application pool identity. That identity can typically read web.config connection strings and machine keys.

What to do now#

1. Find it. On Windows servers: Get-ChildItem -Path D:\inetpub -Recurse -Filter 'AjaxPro*.dll'. In repositories: grep -ril ajaxpro --include=web.config --include=*.csproj --include=packages.config .
2. Upgrade to the official package, for example Install-Package AjaxNetProfessional (Package Manager Console) or dotnet add package AjaxNetProfessional. Remove references to AjaxPro.2, Joint.AjaxPro and JointAjax.AjaxPro, then rebuild and redeploy.
3. Keep the jsonDeserializationCustomTypes setting at default="deny" and allow only your own namespaces, as MOGWAI LABS describes.
4. For a vendor product you cannot rebuild, put /ajaxpro/ behind VPN or an allowlist and press the vendor for a fixed build. A URL Rewrite rule blocking AjaxPro.Services helps, but MOGWAI LABS warns it does not stop the converter-based variant.
5. Run the application pool as a low-privilege identity. Treat any unpatched, internet-facing instance as possibly compromised.

How to tell if you were hit#

Exploit requests are POSTs to /ajaxpro/<Type>,<Assembly>.ashx with an X-Ajaxpro-Method header and a JSON body. Search IIS logs for these, especially calls into AjaxPro.Services classes. If you have WAF or request-body logs, look for __type keys naming system classes. On the host, look for w3wp.exe spawning cmd.exe or powershell.exe, new .aspx or .ashx files in web roots, and unexpected outbound connections. If you find signs of compromise, rebuild the server and rotate everything in web.config: connection strings, API keys and machine keys.

Timeline#

• Oct 27, 2021 — The maintainer commits the deserialization allowlist fix after MOGWAI LABS' report.
• Dec 3, 2021 — CVE-2021-23758 is published.
• Dec 5, 2021 — The project publishes GHSA-6r7c-6w96-8pvw.
• Jan 18, 2022 — MOGWAI LABS publishes its technical write-up.
• Aug 26, 2026 — CISA adds the CVE to KEV, citing evidence of active exploitation.
• Sep 9, 2026 — Federal remediation deadline.

Vulnerability records

• CVE-2021-23758 · KEV 2026-08-26 · All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Ajax.NET Professional / GitHub — GHSA-6r7c-6w96-8pvw: Remote Code Execution (CVE-2021-23758) github.com
2. Ajax.NET Professional / GitHub — Fix commit b0e63be (allowed customized types) github.com
3. CVE record — CVE-2021-23758 cve.org
4. NVD — CVE-2021-23758 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2021-23758 cisa.gov
6. CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog (Aug 26, 2026) cisa.gov
7. MOGWAI LABS — Vulnerability Spotlight: RCE in Ajax.NET Professional mogwailabs.de
8. GitHub Advisory Database — GHSA-6r7c-6w96-8pvw github.com
9. NuGet — AjaxNetProfessional nuget.org
10. Rapid7 Metasploit — AjaxPro Deserialization Remote Code Execution module github.com

Coverage and analysis

1. The Hacker News — CISA Adds Six Exploited Flaws to KEV thehackernews.com