CVE-2021-23758
published 2021-12-03CVE-2021-23758: All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes…
PriorityP198critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-09-09
Exploited in the wild
EPSS
83.63%
99.7th percentile
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| michaelschwarz | ajax.net_professional | < 21.10.30.1 | 21.10.30.1 |
Detection & IOCsextracted from sources · hover to see the quote
url/ajaxpro/
bytes
|5f 5f|type
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT AjaxPro RCE Attempt (CVE-2021-23758)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ajaxpro/"; fast_pattern; http.request_body; content:"|5f 5f|type"; content:"Object"; nocase; reference:url,twitter.com/sirifu4k1/status/1470647490; reference:cve,2021-23758; classtype:attempted-admin; sid:2034729; rev:2; metadata:attack_target Server, created_at 2021_12_14, cve CVE_2021_23758, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2021_12_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
- →Exploit traffic is an HTTP POST request to a URI containing '/ajaxpro/' with a JSON body containing the '__type' key (bytes 5f 5f followed by 'type') and the string 'Object' (case-insensitive). Monitor for this pattern on inbound web traffic.
- →A vulnerable default method exists in the AjaxPro namespace for versions prior to 21.10.30.1, allowing deserialization without any custom code. Post-patch, exploitation still possible if any custom method accepts a parameter of a type assignable from ObjectDataProvider (e.g., 'object'). ↗
- →The exploit constructs malicious JSON data sent to the target, which is deserialized by the AjaxPro JsonDeserializer. Inspect JSON POST bodies to /ajaxpro/ endpoints for unexpected '__type' fields referencing .NET types such as ObjectDataProvider. ↗
- ·Versions prior to 21.10.30.1 are vulnerable via a built-in default method. Version 21.10.30.1 removed the vulnerable method but remains exploitable if any custom application method accepts a parameter type assignable from ObjectDataProvider. ↗
- ·The Snort/ET rule (sid:2034729) targets perimeter and internal deployment and is classified as high confidence / major severity. Ensure it is deployed on both network perimeters and internal segments.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
cisa·2026-08-26·CVSS 9.8
CVE-2021-23758 [CRITICAL] CWE-502 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Vulnerability: Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Affected: Ajax.NET Professional Ajax.NET Professional
Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the prod
VulDB
AjaxPro .NET Class deserialization
vuldb·2026-08-26·CVSS 9.8
CVE-2021-23758 [CRITICAL] AjaxPro .NET Class deserialization
A vulnerability was found in AjaxPro. It has been rated as critical. The affected element is an unknown function of the component .NET Class Handler. The manipulation leads to deserialization.
This vulnerability is listed as CVE-2021-23758. The attack may be initiated remotely. In addition, an exploit is available.
To fix this issue, it is recommended to deploy a patch.
OSV
Duplicate Advisory: Remote Code Execution in AjaxNetProfessional
osv·2021-12-16
CVE-2021-23758 [CRITICAL] Duplicate Advisory: Remote Code Execution in AjaxNetProfessional
Duplicate Advisory: Remote Code Execution in AjaxNetProfessional
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6r7c-6w96-8pvw. This link is maintained to preserve external references.
## Original Description
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
GHSA
Remote Code Execution in AjaxNetProfessional
ghsa·2021-12-07
CVE-2021-23758 [CRITICAL] CWE-502 Remote Code Execution in AjaxNetProfessional
Remote Code Execution in AjaxNetProfessional
### Overview
Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
### Description
Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java
OSV
Remote Code Execution in AjaxNetProfessional
osv·2021-12-07
CVE-2021-23758 [CRITICAL] Remote Code Execution in AjaxNetProfessional
Remote Code Execution in AjaxNetProfessional
### Overview
Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
### Description
Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java
VulnCheck
ajaxpro.2_project ajaxpro.2 Deserialization of Untrusted Data
vulncheck·2021·CVSS 9.8
CVE-2021-23758 [CRITICAL] ajaxpro.2_project ajaxpro.2 Deserialization of Untrusted Data
ajaxpro.2_project ajaxpro.2 Deserialization of Untrusted Data
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
Affected: ajaxpro.2_project ajaxpro.2
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
Suricata
ET EXPLOIT AjaxPro RCE Attempt (CVE-2021-23758)
suricata·2021-12-14·CVSS 8.1
CVE-2021-23758 [HIGH] ET EXPLOIT AjaxPro RCE Attempt (CVE-2021-23758)
ET EXPLOIT AjaxPro RCE Attempt (CVE-2021-23758)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT AjaxPro RCE Attempt (CVE-2021-23758)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ajaxpro/"; fast_pattern; http.request_body; content:"|5f 5f|type"; content:"Object"; nocase; reference:url,twitter.com/sirifu4k1/status/1470647490; reference:cve,2021-23758; classtype:attempted-admin; sid:2034729; rev:2; metadata:attack_target Server, created_at 2021_12_14, cve CVE_2021_23758, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2021_12_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Recorded Future
August 2026 CVE Landscape
blogs_recorded_future·2026-09-08·CVSS 8.8
CVE-2025-62593 [HIGH] August 2026 CVE Landscape
## August 2026 CVE Landscape
In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation , 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month. 31 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 32 were reported in open sources and validated by Insikt Group, seven were sourced through security vendor telemetry, and three were exclusively surfaced through honeypot data.
The 73 vulnerabilities in this blog affected products from 45 vendors, with Microsoft accounting for approximately 11% of the vulnerabilities. The remaining exposure spanned remote monitoring and managemen
Hackernews
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
blogs_hackernews·2026-08-27·CVSS 5.1
CVE-2019-1068 [MEDIUM] CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2019-1068 - A remote code execution vulnerability in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
CVE-2026-8452 - An impr
Hackernews
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
blogs_hackernews·2026-08-24
CVE-2022-0995 UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors.
The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open directory hosted at "139.180.197[.]150," which was observed communicating with one of the compromised machines.
"The actor leveraged publicly d
Talos
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
blogs_talos·2026-08-20
CVE-2022-0995 UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
## UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos identified UAT-10147 targeting Windows and Linux web servers globally, impacting organizations in government, education, media, technology, and gaming sectors. The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale.
UAT-10147 integrated AI-driven tooling into exploitation, reconnaissance, payload generation, validation, and persistence workflows. Talos observed AI-generated operational playbooks, exploit automation scripts, and troubleshooting logic supporting real-world intrusions.
The actor employed a mixture of open-source offensive frameworks, including Metasploit, ysoserial, PentestGPT, DeepAudit, and multiple privilege escalation exploits to au
http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.htmlhttps://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.htmlhttps://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758
2021-12-03
Published
2026-08-26
Added to CISA KEV
Exploited in the wild