---
title: "AjaxPro CVE-2021-23758: Old ASP.NET RCE Now in CISA KEV"
url: https://erroneo.us/security/briefs/ajaxpro-deserialization-rce-cve-2021-23758/
description: "Unauthenticated RCE in the legacy Ajax.NET Professional (AjaxPro) library, in CISA KEV since Aug 2026. Use AjaxNetProfessional 21.12.22.1+. Check old apps."
type: security-brief
section: "Security Digest"
date_published: 2021-12-03
date_modified: 2026-08-26
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-23758"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# AjaxPro CVE-2021-23758: Old ASP.NET RCE Now in CISA KEV

**Verdict: Check exposure.** If an ASP.NET app you run still ships AjaxPro, treat it as an unauthenticated RCE and upgrade or remove the library now; if you never used AjaxPro, there is nothing to do.

- **Who must act:** Owners of ASP.NET Web Forms applications, in-house or bought from a vendor, that bundle AjaxPro.2.dll or register the ajaxpro/*.ashx handler, most urgently on internet-facing servers.
- **Who can relax:** Teams on ASP.NET Core or other stacks that never referenced AjaxPro, AjaxNetProfessional, AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro.
- **Affected:** Ajax.NET Professional (AjaxPro) releases before the late-2021 fix (sources cite 21.10.30.1, 21.11.11.1 or 21.11.29.1 as the cutoff); Unofficial NuGet packages AjaxPro.2 (last release 6.10.6.2, 2016), Joint.AjaxPro and JointAjax.AjaxPro (no patched version listed)
- **Fixed:** AjaxNetProfessional 21.12.22.1 or later on NuGet (also covers CVE-2021-43853 and CVE-2023-49289); AjaxNetProfessional 24.10.10.1 (latest release)
- **CVEs:** CVE-2021-23758
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Search source trees, build output and IIS servers for AjaxPro.2.dll, AjaxPro references in .csproj or packages.config, and ajaxpro/*.ashx handlers in web.config.
2. Replace AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro with the official AjaxNetProfessional package at 21.12.22.1 or later, then rebuild and redeploy.
3. Keep custom JSON deserialization types deny-by-default and allow only your own namespaces.
4. For vendor apps you cannot rebuild, restrict /ajaxpro/ to trusted networks, block AjaxPro.Services requests, and ask the vendor for a fixed build.
5. If an unpatched app was internet-facing, hunt for compromise and rotate secrets stored in its web.config.

### How to check if you are affected

- Search IIS logs for POST requests to /ajaxpro/*.ashx, especially AjaxPro.Services classes, from unfamiliar sources.
- If you keep WAF or request-body logs, look for JSON bodies with __type keys naming system classes.
- Hunt for w3wp.exe spawning cmd.exe or powershell.exe, and for new .aspx or .ashx files in web roots.

## What happened

Ajax.NET Professional (AjaxPro) is one of the oldest AJAX frameworks for ASP.NET. It exposes server methods to the browser through an `ajaxpro/*.ashx` HTTP handler. [CVE-2021-23758](https://www.cve.org/CVERecord?id=CVE-2021-23758), published on December 3, 2021, covers its JSON deserializer. The deserializer trusted a client-supplied `__type` key and would build arbitrary .NET classes. [MOGWAI LABS](https://mogwailabs.de/en/blog/2022/01/vulnerability-spotlight-rce-in-ajax.net-professional/) found the flaw during a penetration test and showed that common ysoserial.net gadgets turn it into remote code execution. The maintainer's [fix](https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57) makes custom deserialization types deny-by-default, and the project published [GHSA-6r7c-6w96-8pvw](https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-6r7c-6w96-8pvw). A public [Metasploit module](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ajaxpro_deserialization_rce.rb) now automates the attack.

Nearly five years later, on August 26, 2026, CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758) and set a September 9 deadline for federal agencies. CISA's [alert](https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog) says only that the addition is "based on evidence of active exploitation". The entry lists ransomware use as unknown and notes the product could be end-of-life. As of October 21, 2026, no attacker, campaign or victim had been named publicly, and [The Hacker News](https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html) coverage adds none. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-23758) scores the flaw CVSS 3.1 9.8. The original CNA, Snyk, rates it 8.1 with high attack complexity.

## Who is affected

The library is .NET-only and mostly shows up in older ASP.NET Web Forms applications: intranet portals, line-of-business apps, and commercial products with .NET web front ends. It may sit in `bin/` as a copied DLL rather than as a NuGet reference. Sources disagree on the exact first safe release:

- NVD's configuration data flags versions before 21.10.30.1. MOGWAI LABS says the fix landed in 21.11.11.1. The [GitHub advisory](https://github.com/advisories/GHSA-6r7c-6w96-8pvw) lists 21.11.29.1 as patched.
- The Metasploit module notes that 21.10.30.1 removed the vulnerable default method but stays exploitable if the app exposes its own method that accepts an `object` parameter.
- The unofficial NuGet packages that many old projects reference, `AjaxPro.2` (last release 6.10.6.2, in 2016), `Joint.AjaxPro` and `JointAjax.AjaxPro`, have no patched version listed in the maintainer's advisories.

The safe target is the official [AjaxNetProfessional](https://www.nuget.org/packages/AjaxNetProfessional) package at 21.12.22.1 or later. That release also fixes two later AjaxPro advisories. The current version is 24.10.10.1.

## Do you really need to act?

Most teams don't. If you build on ASP.NET Core, Java, Node or anything else that never pulled in AjaxPro, this entry is not about you. The risk is concentrated in forgotten legacy apps, the kind where nobody remembers the DLL is there. If you find AjaxPro on an internet-facing site, treat it as act-now. No login is needed, a ready-made exploit exists, and CISA has confirmed exploitation. On internal-only apps the urgency is lower, but this is still code execution as the IIS application pool identity. That identity can typically read `web.config` connection strings and machine keys.

## What to do now

1. Find it. On Windows servers: `Get-ChildItem -Path D:\inetpub -Recurse -Filter 'AjaxPro*.dll'`. In repositories: `grep -ril ajaxpro --include=web.config --include=*.csproj --include=packages.config .`
2. Upgrade to the official package, for example `Install-Package AjaxNetProfessional` (Package Manager Console) or `dotnet add package AjaxNetProfessional`. Remove references to `AjaxPro.2`, `Joint.AjaxPro` and `JointAjax.AjaxPro`, then rebuild and redeploy.
3. Keep the `jsonDeserializationCustomTypes` setting at `default="deny"` and allow only your own namespaces, as MOGWAI LABS describes.
4. For a vendor product you cannot rebuild, put `/ajaxpro/` behind VPN or an allowlist and press the vendor for a fixed build. A URL Rewrite rule blocking `AjaxPro.Services` helps, but MOGWAI LABS warns it does not stop the converter-based variant.
5. Run the application pool as a low-privilege identity. Treat any unpatched, internet-facing instance as possibly compromised.

## How to tell if you were hit

Exploit requests are POSTs to `/ajaxpro/<Type>,<Assembly>.ashx` with an `X-Ajaxpro-Method` header and a JSON body. Search IIS logs for these, especially calls into `AjaxPro.Services` classes. If you have WAF or request-body logs, look for `__type` keys naming system classes. On the host, look for `w3wp.exe` spawning `cmd.exe` or `powershell.exe`, new `.aspx` or `.ashx` files in web roots, and unexpected outbound connections. If you find signs of compromise, rebuild the server and rotate everything in `web.config`: connection strings, API keys and machine keys.

## Timeline

- Oct 27, 2021 — The maintainer commits the deserialization allowlist fix after MOGWAI LABS' report.
- Dec 3, 2021 — CVE-2021-23758 is published.
- Dec 5, 2021 — The project publishes GHSA-6r7c-6w96-8pvw.
- Jan 18, 2022 — MOGWAI LABS publishes its technical write-up.
- Aug 26, 2026 — CISA adds the CVE to KEV, citing evidence of active exploitation.
- Sep 9, 2026 — Federal remediation deadline.

## Sources

1. [Ajax.NET Professional / GitHub — GHSA-6r7c-6w96-8pvw: Remote Code Execution (CVE-2021-23758)](https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-6r7c-6w96-8pvw)
2. [Ajax.NET Professional / GitHub — Fix commit b0e63be (allowed customized types)](https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57)
3. [CVE record — CVE-2021-23758](https://www.cve.org/CVERecord?id=CVE-2021-23758)
4. [NVD — CVE-2021-23758](https://nvd.nist.gov/vuln/detail/CVE-2021-23758)
5. [CISA — Known Exploited Vulnerabilities: CVE-2021-23758](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758)
6. [CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog (Aug 26, 2026)](https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog)
7. [MOGWAI LABS — Vulnerability Spotlight: RCE in Ajax.NET Professional](https://mogwailabs.de/en/blog/2022/01/vulnerability-spotlight-rce-in-ajax.net-professional/)
8. [GitHub Advisory Database — GHSA-6r7c-6w96-8pvw](https://github.com/advisories/GHSA-6r7c-6w96-8pvw)
9. [NuGet — AjaxNetProfessional](https://www.nuget.org/packages/AjaxNetProfessional)
10. [Rapid7 Metasploit — AjaxPro Deserialization Remote Code Execution module](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ajaxpro_deserialization_rce.rb)
11. [The Hacker News — CISA Adds Six Exploited Flaws to KEV](https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html)

---
Source page: https://erroneo.us/security/briefs/ajaxpro-deserialization-rce-cve-2021-23758/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt