# CVE-2021-23758: Remote Code Execution in AjaxNetProfessional

Source: https://junglewise.ai/threats/cve-2021-23758-ajax-net-professional-unsafe-deserialization-of-untrusted-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-07. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2021-23758 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2021-12-07

Ajax.NET Professional is a framework used to integrate ASP.NET applications with JavaScript front-ends through automated serialization and RPC-style calls. A vulnerability in how the framework deserializes untrusted data allows attackers to execute arbitrary .NET code on the server. This could lead to complete server compromise, data theft, and service disruption.

Technologies: [AjaxNetProfessional (NuGet)](https://junglewise.ai/threats/technologies/ajaxnetprofessional). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2021-23758 exploited in the wild?** Yes. CVE-2021-23758 is known to be exploited in the wild, first recorded on 26 August 2026. Treat it as urgent.

**How severe is CVE-2021-23758?** Critical severity, with a CVSS score of 3.1, published 7 December 2021.

**Which products and versions are affected?** AjaxNetProfessional (NuGet) ECOSYSTEM:introduced=0,fixed=21.11.29.1.

**Is there a fix for CVE-2021-23758?** Yes. AjaxNetProfessional (NuGet): upgrade to 21.11.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-23758 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-23758?** Check whether you run Ajax.Net Professional or AjaxNetProfessional (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- AjaxNetProfessional (NuGet): upgrade to 21.11.29.1 or later

  ```sh
  dotnet add package AjaxNetProfessional --version 21.11.29.1
  ```


## Technical details

Ajax.NET Professional is vulnerable to unsafe deserialization of untrusted data, a well-known attack pattern in .NET environments. The framework fails to properly validate or sandbox serialized object instantiation, allowing an attacker to craft malicious serialized payloads that instantiate arbitrary .NET classes with arbitrary constructor arguments. This vulnerability is remotely exploitable over the network without requiring authentication, as the deserialization occurs during request processing. An attacker can achieve remote code execution by leveraging gadget chains (such as those in the .NET Framework or third-party libraries) to achieve code execution during object deserialization. The product appears to be end-of-life or end-of-service, and no patch is expected; users should discontinue use or migrate to supported alternatives.

## Affected products

- Ajax.NET Ajax.NET Professional

## Identifiers

- CVE-2021-23758
- GHSA-6r7c-6w96-8pvw

## Timeline

- 2021: disclosed: CVE-2021-23758 assigned
- 2021: exploited: Reported exploited in the wild

## Related threats

- [Ajax Pro Cross-site Scripting](https://junglewise.ai/threats/cve-2023-49289-ajax-pro-cross-site-scripting)
- [AjaxNetProfessional deserializes arbitrary JavaScript objects](https://junglewise.ai/threats/cve-2021-43853-ajaxnetprofessional-deserializes-arbitrary-javascript-objects)
- [Duplicate Advisory: Remote Code Execution in AjaxNetProfessional](https://junglewise.ai/threats/duplicate-advisory-remote-code-execution-in-ajaxnetprofessional-d122e02f)