CVE-2021-23758Active Exploitation(ajaxpro.2_project / ajax.net_professional)

HIGHCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 9 mentions and remains active

Immediate actions

Patch ajaxpro.2_project ajax.net_professional systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

ajaxpro.2_project CVEs Back to dashboard

6.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-09. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

Exploit / PoC references

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758

Weakness type (CWE)

CWE-502

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ajax.net_professional
ajaxpro.2

Threat summary

Active exploitation appears in 12 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
17 mentions across 5 observed days

What's happening

Active exploitation reported across 12 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 5 signals
Technical details provided in 12 signals
Disclosure: 2 classified signals
Peaked 3d ago at 9 mentions (2026-08-27); latest day: 1
17 total mentions across 5 days

Affected systems

Vendors

ajaxpro.2_project michaelschwarz

Products

ajax.net_professionalajaxpro.2

Deep dive

Activity timeline17 mentions / 5d

Signal classification4 categories

Active Exploitation

1270.6%

Disclosure

211.8%

Patch

211.8%

General

15.9%

Referenced assets16 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-26	5	Active Exploitation4Disclosure1
2026-08-27	9	Active Exploitation5Disclosure1General1Patch2
2026-08-28	1	Active Exploitation1
2026-09-01	1	Active Exploitation1
2026-09-02	1	Active Exploitation1

Full discourse17 posts

piyokango@piyokango45d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（08/26追加） #vulnerability 🛡CVE-2015-5287Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability ✅概要・深刻度：注意 6.9 (CVSS Base) / NVD ・種別：リンク解釈の問題 (CWE-59) ・CVSS:AV:L/AC:M/Au:N/C:C/I:C/A:C Red Hat Automatic Bug Reporting Tool（ABRT）に存在する権限昇格の脆弱性です。 ABRT 2.7.1未満では、一定の権限を持つローカルユーザーが予測可能なファイル名に対するシンボリックリンク攻撃を行うことで、権限を昇格できる可能性があります。 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Cisco Talos）・概要：Cisco Talosは、UAT-10147がCVE-2015-5287をLinux環境での権限昇格に悪用していることを確認し、公表しています。 🛡CVE-2019-1068Microsoft SQL Server Remote Code Execution Vulnerability ✅概要・深刻度：重要 8.8 (CVSS Base) / NVD ・種別：不適切な入力確認 (CWE-20) ・CVSS:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Microsoft SQL Serverに存在するリモートコード実行の脆弱性です。 SQL Serverが内部関数の処理を不適切に行うことに起因し、低い権限を持つリモート攻撃者が悪用することで任意コードを実行できる可能性があります。 SQL Server 2014、2016、2017の複数のサービスパックおよび更新系統が影響を受けます。 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：未確認 🛡CVE-2021-23758 http://Ajax.NET Professional Deserialization of Untrusted Data Vulnerability ✅概要・深刻度：緊急 9.8 (CVSS Base) / NVD ・種別：信頼できないデータのデシリアライゼーション (CWE-502) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H http://Ajax.NET Professional（AjaxPro.2）に存在する、信頼できないデータのデシリアライゼーションの脆弱性です。未認証のリモート攻撃者が任意の.NETクラスをデシリアライズさせることで、対象サーバー上で任意コードを実行できる可能性があります。 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Cisco Talos）・概要：Cisco Talosは、UAT-10147がCVE-2021-23758をAjaxProに対するリモートコード実行に悪用していることを確認し、公表しています。 🛡CVE-2022-0995Linux Kernel Out-of-Bounds Write Vulnerability ✅概要・深刻度：重要 7.8 (CVSS Base) / NVD ・種別：境界外書き込み (CWE-787) ・CVSS:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Linux Kernelのwatch_queueイベント通知サブシステムに存在する境界外書き込みの脆弱性です。低い権限を持つローカルユーザーがカーネルメモリの境界外へ書き込むことで、権限昇格やサービス拒否を引き起こす可能性があります。 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Cisco Talos）・概要：Cisco Talosは、UAT-10147がCVE-2022-0995をLinux環境での権限昇格に悪用していることを確認し、公表しています。 🛡CVE-2026-8452Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability ✅概要・深刻度：緊急 9.8 (CVSS Base) / NVD ・種別：バッファエラー (CWE-119) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NetScaler ADCおよびNetScaler Gatewayに存在するメモリオーバーフローの脆弱性です。 Gateway（SSL VPN、ICA Proxy、CVPN、RDP Proxy）またはAAA仮想サーバーとして構成されている場合、未認証のリモート攻撃者による悪用で予期しない動作やサービス拒否が発生する可能性があります。修正版は14.1-72.61、13.1-63.18、14.1 FIPS 72.61、13.1 FIPS/NDcPP 37.272です。 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Previdian）・概要：Previdianは、2026年8月17日にCVE-2026-8452の悪用試行を自社センサーで観測したと公表しています。
Post summary
The post reports multiple CVEs added to CISA’s KEV catalog, provides detailed vulnerability data and PoC references, confirms active exploitation by security communities, and cites available patches or mitigations.
100725.9K
45.5K followersView on X
NotCVE@notCVE40d
Active Exploitation
⚠️ New in CISA KEV this month — exploited in the wild: • PaperCut NG/MF Missing… — CVSS 9.8 https://notcve.org/cve/CVE-2026-81578 • ownCloud Improper Authentication — CVSS 9.8 https://notcve.org/cve/CVE-2023-49105 • https://Ajax.NET Professional… — CVSS 9.8 https://notcve.org/cve/CVE-2021-23758
Post summary
The post highlights three high‑severity CVEs that have been added to the CISA KEV list and are reportedly being exploited in the wild, with no PoC, exploit code or patch details disclosed.
1000063
70 followersView on X
Cybersecurity News DE@cybsecuritynews45d
Active Exploitation
#schwachstellen CVE-2021-23758 in https://Ajax.NET Professional wird aktiv ausgenutzt #ajaxnetprofessional #ajaxpro #cisakev #cve202123758 https://cybersecurity-news.de/cve-2021-23758-ajax-net-professional-aktiv-ausgenutzt
Post summary
The tweet asserts that CVE‑2021‑23758 in Ajax.NET Professional is currently being exploited in the wild, without providing a PoC, exploit tool details, patch or technical vulnerability information.
0001094
10 followersView on X
PCMedicalist@PCMedicalist45d
Patch
PCMedicalist Signal · Aug 27 https://CVE-2021-23758--Ajax.NET Professional: patch https://Ajax.NET Professional and validate deserialization bounds. Full brief 👇 #CyberSecurity #Vulnerability #InfoSec PCMedicalist · https://pcmedicalist.com/intel https://t.co/DbhdsDxLae
Post summary
The tweet highlights CVE-2021-23758 and points to a patch from Ajax.NET Professional, noting a fix that validates deserialization bounds. No exploit or active exploitation info is provided.
0001043
141 followersView on X
NotCVE@notCVE46d
Active Exploitation
⚠️ ACTIVELY EXPLOITED — added to CISA KEV 2026-08-26 CVE-2021-23758: https://Ajax.NET Professional Deserialization of Untrusted Data Vulnerability CVSS 9.8 · EPSS 89.1% · 8 public exploits Details, versions & intel → https://notcve.org/cve/CVE-2021-23758 https://t.co/xEGNvDBIfb
Post summary
CVE‑2021‑23758 is an actively exploited deserialization flaw with high severity, now listed in the CISA KEV and supported by multiple public exploits.
1000068
68 followersView on X
CiberPlaneta@CiberPlanetaOrg46d
Active Exploitation
🛡️ CVE-2021-23758: Deserialización en http://Ajax.NET Professional permite ejecución remota de código Análisis técnico de CVE-2021-23758, vulnerabilidad crítica de deserialización en http://Ajax.NET Professional que permite RCE. Explotación activa confirmada por CISA. https://www.ciberplaneta.org/vulnerabilidades/cve-2021-23758-deserializacion-en-ajaxnet-professional-permite-ejecucion-remota-de-codigo/ #ciberplaneta #vulnerabilidades #cve_2021_23758 #cve #vulnerabilidad #ajaxnet_professional #seguridad #infosec #ciberseguridad
Post summary
CISA confirms that CVE-2021-23758, a critical deserialization flaw in Ajax.NET Professional, is being actively exploited to achieve remote code execution.
0001030
7 followersView on X
DFIR Lab@DFIR_Lab40d
Active Exploitation
🚨 CRITICAL: CVE-2021-23758 - Ajax[.]NET Professional deserialization flaw enables remote code execution. Product may be EoL/EoS. CISA KEV listed. Discontinue use immediately. Migrate to supported alternatives. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/zxnyfd9q0M
Post summary
A critical deserialization flaw in Ajax.NET Professional allows remote code execution, with active exploitation confirmed by CISA KEV, urging immediate discontinuation and migration to supported alternatives.
0000074
122 followersView on X
Soy Nube Negra@Soy_Nube_Negra44d
Active Exploitation
🛡️ CISA KEV — seis fallas nuevas, de NetScaler a Linux kernel, con fecha límite 29 de agosto Impacto: CVE-2019-1068 en SQL Server, CVE-2026-8452 en NetScaler, CVE-2022-0995 en Linux kernel y tres de Red Hat más CVE-2021-23758 afectan appliances de borde y servidores web. Estado: explotadas por el grupo chino UAT-10147 según Talos y con 36 intentos en 12 días desde 12 IPs. Plazo federal: 29 de agosto para NetScaler/SQL Server y 9 de septiembre para el resto. Acción hoy: 1. Parchear NetScaler, SQL Server e internet-facing Linux primero. 2. Revisar versiones sin soporte que nunca recibirán fix. 3. Priorizar lo expuesto antes que lo interno. Un KEV que mezcla vulnerabilidades de 2015 con 2026 recuerda que la edad no baja el riesgo. Sigue a @Soy_Nube_Negra si te sirve este tipo de análisis. https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html
Post summary
The advisory confirms active exploitation of listed CVEs and urges prompt patching, offering minimal technical detail beyond identifiers and affected platforms.
0000071
1.9K followersView on X
NewNormal Security@NewScanTeam45d
General
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 27 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🚨 Unpatched Citrix NetScaler Gateway — version-gated advisory match for a memory overflow that crashes the VPN gateway, as seen in Citrix CVE-2026-8452 ⚡ Outdated self-hosted Gitea — an admin-authenticated API call plants a Git hook for remote code execution, as seen in Gitea CVE-2026-60004 🖥️ Exposed AjaxPro .NET handler — unauthenticated deserialization to remote code execution, every ajaxpro.2 build affected, as seen in AjaxPro CVE-2021-23758 Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RCE #CSO #REDTEAM
Post summary
The tweet lists three newly reported CVEs, describing a memory overflow crash in Citrix NetScaler Gateway, a remote code execution flaw in Gitea, and an unauthenticated deserialization RCE in AjaxPro, but does not provide any PoC, exploit, or patch details.
0000050
5 followersView on X
DailyCVE@dailycve45d
Disclosure
🔴 AjaxPro2 NET Deserialization Remote Code Execution, #CVE-2021-23758 (High) -DC-Aug2026-1964 https://dailycve.com/ajaxpro2-net-deserialization-remote-code-execution-cve-2021-23758-high-dc-aug2026-1964/
Post summary
The text announces a high‑severity CVE‑2021‑23758 for AjaxPro2, highlighting deserialization‑based remote code execution, but offers no PoC, exploit, patch, or evidence of active exploitation.
0000016
230 followersView on X
SecNews@SecNews_GR46d
Active Exploitation
CVE-2021-23758: Κρίσιμη ευπάθεια στο https://Ajax.NET Professional υπό εκμετάλλευση https://secn.ws/HocWFa
Post summary
CVE-2021-23758 is a critical vulnerability in Ajax.NET Professional that is reportedly being exploited in the wild, as indicated by the phrase 'under exploitation' and a reference link.
00000144
7.0K followersView on X
PCMedicalist@PCMedicalist46d
Patch
🔐 Daily Security & Standards Brief (Aug 26) https://CVE-2021-23758--Ajax.NET Professional: patch https://Ajax.NET Professional and validate deserialization bounds. Full digest 👇 via PCMedicalist #CyberSecurity #InfoSec https://t.co/syY7zaFDjU
Post summary
A patch for Ajax.NET Professional CVE‑2021‑23758 is announced, addressing deserialization bounds; no active exploitation or PoC is reported.
0000038
142 followersView on X
Security Arsenal, LLC@SecurityAr5840946d
Active Exploitation
🔒 #CyberSecurity http://Ajax.NET Professional (AjaxPro) Deserialization Flaw Actively Exploited — CISA … "On August 26, 2026, CISA added CVE-2021-23758 — a deserialization of untrusted data…" 🔗 https://securityarsenal.com/blog/ajaxnet-professional-ajaxpro-deserialization-flaw-actively-exploited-cisa-kev-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve202123758 #critical #cisakev
Post summary
CISA has added CVE-2021-23758 to its KEV list after detecting active exploitation of a deserialization flaw in Ajax.NET Professional, but the tweet does not provide patch info or a PoC.
0000032
29 followersView on X
キタきつね@foxbook46d
Active Exploitation
CISAが既知の悪用された脆弱性6件をカタログに追加 CISA Adds Six Known Exploited Vulnerabilities to Catalog #CISA (Aug 26) CVE-2015-3246 Red Hat Libuserの競合状態の脆弱性 CVE-2015-5287 Red Hat自動バグ報告ツールにおける権限昇格の脆弱性 CVE-2019-1068 Microsoft SQL Serverのリモートコード実行の脆弱性 CVE-2021-23758 http://Ajax.NET Professionalにおける信頼できないデータの逆シリアル化の脆弱性 CVE-2022-0995 Linuxカーネルの境界外書き込みの脆弱性 CVE-2026-8452 Citrix NetScaler ADCおよびNetScaler Gatewayにおけるメモリバッファの範囲内での操作の不適切な制限の脆弱性 https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
Post summary
CISA has cataloged six CVEs that are known to be exploited in the wild, providing brief technical details for each but no PoC, exploit code, or patch information.
00000304
4.9K followersView on X
DFIR Lab@DFIR_Lab46d
Active Exploitation
🚨 CRITICAL: CVE-2021-23758 - Ajax[.]NET Professional deserialization flaw enables remote code execution. CISA KEV listed. Product may be EoL/EoS. Discontinue use immediately. #CVE #PatchNow #ThreatIntel #DFIR https://t.co/cOKFXPjxAk
Post summary
The tweet highlights that CVE‑2021‑23758, a deserialization flaw in Ajax.NET Professional that allows remote code execution, has been listed by CISA as a known exploit, prompting users to immediately cease use.
00000184
115 followersView on X
CiberPlaneta@CiberPlanetaOrg46d
Disclosure
🛡️ Alerta de Seguridad: http://Ajax.NET Professional - Deserialización de Datos No Confiables con Ejecución Remota de Código (CVE-2021-23758) CVE-2021-23758 (CVSS 8.1/ALTA): Deserialización insegura en http://Ajax.NET Professional permite RCE mediante clases .NET arbitrarias. Producto posiblemente EoL/EoS. https://www.ciberplaneta.org/boletines/156/ #ciberplaneta #bulletin #cybersecurity #cve #ajaxnet_professional #deserialization #cwe_502 #rce #kev #cisa #dotnet #aspnet #ioc #infosec #ciberseguridad
Post summary
The alert announces CVE‑2021‑23758, a high‑severity deserialization flaw in Ajax.NET Professional that enables remote code execution through arbitrary .NET classes, but provides no PoC, active exploitation evidence, or patch information.
0000023
7 followersView on X
Kaotick Jay@kaotickjay46d
Active Exploitation
CISA adds 6 active exploits to KEV • CVE-2015-3246 — Red Hat Libuser • CVE-2015-5287 — Red Hat ABRT • CVE-2019-1068 — Microsoft SQL Server • CVE-2021-23758 — https://Ajax.NET Professional • CVE-2022-0995 — Linux Kernel • CVE-2026-8452 — Citrix NetScaler ADC/Gateway
Post summary
CISA confirms that six CVEs are actively exploited in the wild, adding them to the known exploited vulnerabilities list.
0000061
13 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ajaxpro.2_project	ajaxpro.2	-	.net	-
App	michaelschwarz	ajax.net_professional	-	.net	-

Explore more

Back to dashboard ajaxpro.2_project CVEs michaelschwarz CVEs ajax.net_professional vulnerabilities

What researchers are saying

CVE-2021-23758

piyokango[verified]@piyokangoActive Exploitation

The post reports multiple CVEs added to CISA’s KEV catalog, provides detailed vulnerability data and PoC references, confirms active exploitation by security communities, and cites available patches or mitigations.

DFIR Lab[verified]@DFIR_LabActive Exploitation

A critical deserialization flaw in Ajax.NET Professional allows remote code execution, with active exploitation confirmed by CISA KEV, urging immediate discontinuation and migration to supported alternatives.

Soy Nube Negra[verified]@Soy_Nube_NegraActive Exploitation

The advisory confirms active exploitation of listed CVEs and urges prompt patching, offering minimal technical detail beyond identifiers and affected platforms.

NewNormal Security[verified]@NewScanTeamGeneral

The tweet lists three newly reported CVEs, describing a memory overflow crash in Citrix NetScaler Gateway, a remote code execution flaw in Gitea, and an unauthenticated deserialization RCE in AjaxPro, but does not provide any PoC, exploit, or patch details.

SecNews[verified]@SecNews_GRActive Exploitation

CVE-2021-23758 is a critical vulnerability in Ajax.NET Professional that is reportedly being exploited in the wild, as indicated by the phrase 'under exploitation' and a reference link.

Security Arsenal, LLC[verified]@SecurityAr58409Active Exploitation

CISA has added CVE-2021-23758 to its KEV list after detecting active exploitation of a deserialization flaw in Ajax.NET Professional, but the tweet does not provide patch info or a PoC.

キタきつね[verified]@foxbookActive Exploitation

CISA has cataloged six CVEs that are known to be exploited in the wild, providing brief technical details for each but no PoC, exploit code, or patch information.

DFIR Lab[verified]@DFIR_LabActive Exploitation

The tweet highlights that CVE‑2021‑23758, a deserialization flaw in Ajax.NET Professional that allows remote code execution, has been listed by CISA as a known exploit, prompting users to immediately cease use.