CISA KEV Adds AjaxPro Deserialization Flaw (CVE-2021-23758) Amid Active Exploitation

What happened

CISA has added CVE-2021-23758, a deserialization of untrusted data vulnerability in Ajax.NET Professional (AjaxPro), to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. The flaw allows an attacker to trigger deserialization of arbitrary .NET classes, which can lead to remote code execution. CISA notes the impacted product may be end-of-life (EoL) or end-of-service (EoS), and recommends discontinuing use or migrating to a supported alternative rather than expecting a patch.

Why it matters

AjaxPro is an older .NET AJAX framework that may still be embedded in legacy ASP.NET web applications, sometimes without administrators being fully aware it's present as a dependency. Deserialization vulnerabilities of this type are historically attractive to attackers because they frequently provide a direct path to remote code execution on the web server. Because the product is reportedly EoL/EoS, there may be no vendor patch available, leaving affected organizations dependent on mitigation, isolation, or replacement rather than remediation.

What defenders should do now

• Inventory internet-facing ASP.NET applications for AjaxPro / Ajax.NET Professional components, including as a transitive dependency in older web apps.
• If AjaxPro is present, prioritize migrating off the framework or decommissioning the affected application, per CISA's EoL/EoS guidance.
• Where immediate removal isn't feasible, restrict external access to AjaxPro handler endpoints (commonly exposed via .ashx paths) via WAF rules or network controls.
• Hunt for anomalous POST requests to AjaxPro handler endpoints, unexpected child processes spawned by IIS/w3wp.exe worker processes, or unusual .NET object instantiation/reflection activity in application logs.
• Review outbound connections and process creation from web servers hosting legacy .NET applications for signs of post-exploitation activity.

Developing intel

This is a fresh KEV addition; specifics on the exploitation campaign, actors involved, and any ransomware association have not been detailed by CISA at this time. Organizations running Ajax.NET Professional should treat this as active-exploitation risk and act promptly. For technical details on the vulnerability, see the original source commit.