Is CVE-2021-23758 exploited in the wild?

Yes. CVE-2021-23758 is known to be exploited in the wild, first recorded on 26 August 2026. Treat it as urgent.

How severe is CVE-2021-23758?

Critical severity, with a CVSS score of 3.1, published 7 December 2021.

Which products and versions are affected?

AjaxNetProfessional (NuGet) ECOSYSTEM:introduced=0,fixed=21.11.29.1.

Is there a fix for CVE-2021-23758?

Yes. AjaxNetProfessional (NuGet): upgrade to 21.11.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-23758 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-23758?

Check whether you run Ajax.Net Professional or AjaxNetProfessional (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-23758: Remote Code Execution in AjaxNetProfessional

CVE-2021-23758 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2021-12-07

Ajax.NET Professional is a framework used to integrate ASP.NET applications with JavaScript front-ends through automated serialization and RPC-style calls. A vulnerability in how the framework deserializes untrusted data allows attackers to execute arbitrary .NET code on the server. This could lead to complete server compromise, data theft, and service disruption.

Technologies: AjaxNetProfessional (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2021-23758 exploited in the wild?: Yes. CVE-2021-23758 is known to be exploited in the wild, first recorded on 26 August 2026. Treat it as urgent.
How severe is CVE-2021-23758?: Critical severity, with a CVSS score of 3.1, published 7 December 2021.
Which products and versions are affected?: AjaxNetProfessional (NuGet) ECOSYSTEM:introduced=0,fixed=21.11.29.1.
Is there a fix for CVE-2021-23758?: Yes. AjaxNetProfessional (NuGet): upgrade to 21.11.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23758 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-23758?: Check whether you run Ajax.Net Professional or AjaxNetProfessional (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

AjaxNetProfessional (NuGet): upgrade to 21.11.29.1 or later

dotnet add package AjaxNetProfessional --version 21.11.29.1

Technical details

Ajax.NET Professional is vulnerable to unsafe deserialization of untrusted data, a well-known attack pattern in .NET environments. The framework fails to properly validate or sandbox serialized object instantiation, allowing an attacker to craft malicious serialized payloads that instantiate arbitrary .NET classes with arbitrary constructor arguments. This vulnerability is remotely exploitable over the network without requiring authentication, as the deserialization occurs during request processing. An attacker can achieve remote code execution by leveraging gadget chains (such as those in the .NET Framework or third-party libraries) to achieve code execution during object deserialization. The product appears to be end-of-life or end-of-service, and no patch is expected; users should discontinue use or migrate to supported alternatives.

Affected products

Ajax.NET Ajax.NET Professional

Identifiers

CVE-2021-23758
GHSA-6r7c-6w96-8pvw

Timeline

2021: disclosed: CVE-2021-23758 assigned
2021: exploited: Reported exploited in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.