Ajaxpro.2_project zero-day lets attackers run code
A.NET web library called AjaxPro.2 lets an outside attacker send it rigged data that tricks the server into running its own commands. That can hand the attacker full control of the website or web app using it.
- Severity
- HighCVSS 3.1 ยท 8.1
- Fix
- Fixed in 21.10.30.1Fix recorded on Aug 26, 2026
- Affected versions
- before unspecified
- Weakness
- CWE-502Deserialization of Untrusted Data
- Exploit likelihood
- 84% in 30 daysEPSS, higher than 100% of known flaws
- Affects
- AjaxPro.2
- Exploited
- Yes, in the wildListed by CISA
- Added to CISA list
- Aug 26, 2026
- Federal fix deadline
- Sep 9, 2026
How it works
The library takes data sent by a visitor's browser and rebuilds it back into.NET program objects without checking what those objects actually are, so an attacker can send a rigged object that runs its own code the moment the server rebuilds it.
What to do
Check whether your project references the ajaxpro.2 NuGet package and. If so, what version is installed; every versions older than 21.10.30.1 is vulnerable.
Run this in the application environment you want to check:
npm list ajaxpro.2 ajaxpro.2_projectUpdate the ajaxpro.2 package to version 21.10.30.1 or later through NuGet, then confirm the new version is what's actually deployed to the live server.
Technical details
CVE-2021-23758 affects all versions of the ajaxpro.2 NuGet package before 21.10.30.1. The library deserializes arbitrary.NET classes from client-supplied data without restricting which types can be instantiated, a classic CWE-502 insecure deserialization flaw. Because deserialization can trigger constructors and property setters before any type check occurs, an attacker who controls the serialized payload can chain available classes on the server to achieve remote code execution. NVD lists the fix in 21.10.30.1; EPSS scores this a high exploitation probability, reflecting that insecure.NET deserialization bugs are a well-known, actively probed exploitation class.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity High Attack depends on conditions outside the attacker's control
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator