1. Executive summary
Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability (CVE-2021-23758) rated CVSS 8.1 HIGH, enabling remote code execution through abuse of arbitrary .NET classes. The flaw is listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue as of 2026-08-26 with an EPSS probability of 89%, indicating near-certain active exploitation. The product is likely end-of-life/end-of-service, meaning no vendor patch is expected; EMEA financial services with legacy ASP.NET applications embedding AjaxPro face immediate RCE risk on internet-exposed assets. The CISA KEV remediation due date is 2026-09-09.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | The vulnerability is in CISA KEV with EPSS 89% and the product is EoL/EoS, requiring risk-prioritised testing of whether supported alternatives exist. | Clients must include this CVE in their ICT resilience testing programme and document the risk decision for any retained AjaxPro components. |
| NIS2 Art. 21(2)(d): supply chain security measures | The affected product is end-of-life/end-of-service, meaning the supplier will not issue a security fix — a supply-chain security gap. | Clients holding AjaxPro in their stack must evaluate and document this as a third-party component risk and plan migration to supported alternatives. |
3. Technical analysis & attack chain
Vulnerability mechanism: Ajax.NET Professional (AjaxPro) is vulnerable to deserialization of untrusted data (CWE-502). The flaw allows an attacker to supply crafted serialized data that, when deserialized by the AjaxPro framework, instantiates arbitrary .NET classes. Because .NET deserialization gadgets can achieve code execution during object construction, this translates to remote code execution under the application pool identity of the hosting IIS/ASP.NET process.
Attack chain (confirmed steps)
- Reconnaissance — Attacker identifies an internet-exposed ASP.NET application using AjaxPro, typically by fingerprinting AjaxPro-specific endpoints or HTTP response headers (e.g.,
AjaxPro.*JSON endpoints orapplication/jsonhandlers registered toajaxpro/*.ashx). - Payload delivery — Attacker sends a crafted HTTP request (POST) to an AjaxPro endpoint containing a malicious serialized .NET object graph using known gadget chains available in the .NET framework (e.g.,
System.Configuration.Install.AssemblyInstaller,System.Workflow.ComponentModel). - Deserialization & RCE — AjaxPro deserializes the untrusted payload without type restriction, instantiating the attacker-specified .NET classes and executing arbitrary code in the context of the IIS worker process (
w3wp.exe). - Post-exploitation — Code execution inherits the privileges of the application pool identity. Depending on configuration, this may permit file system access, credential theft from application configuration files (e.g.,
web.configconnection strings), or lateral movement via stolen service accounts.
Key technical details
- Affected component: Ajax.NET Professional (AjaxPro) — all versions (product is EoL/EoS).
- Root cause: Absence of type allow-listing (serialization binder) during deserialization of incoming JSON/XML data at AjaxPro handler endpoints.
- Impact: Remote code execution.
- Exploitation status: CISA KEV-listed (added 2026-08-26); EPSS 89%. Specific threat actor attribution is not available in the provided source material — treat as unconfirmed.
Confidence caveat: The attack chain steps 1–4 are derived from the confirmed CWE-502 classification and the known mechanics of .NET deserialization vulnerabilities. The specific exploitation method (endpoint fingerprinting, gadget chain names) is inferred from the vulnerability class and product architecture, not from a published exploit write-up in the provided sources. Single-sourced; verify before enforcement.
4. Mitigation & containment
P1 — Within 24 hours
- Identify exposure: Search all ASP.NET application directories for AjaxPro assemblies. Look for
AjaxPro.2.dllorAjaxPro.dllin application/binfolders, and for AjaxPro handler registrations inweb.config(search for<add verb="POST,GET" path="ajaxpro/*.ashx"ortype="AjaxPro.AjaxHandlerFactory"). - Contain internet-exposed instances: If any internet-facing application uses AjaxPro, place it behind WAF rules that block requests to
*/ajaxpro/*.ashxendpoints, or restrict access to the application via IP allow-listing while remediation is planned. - Inventory: Compile a full asset inventory of all applications (internal and external) using AjaxPro, including version, owner, and business criticality.
P2 — Within 72 hours
- Disable AjaxPro endpoints: For applications where AjaxPro functionality is not critical, remove or comment out the AjaxPro HTTP handler registration in
web.configand delete theAjaxPro.2.dll/AjaxPro.dllfrom the/bindirectory. Recycle the IIS application pool. - Network segmentation: Ensure internal applications using AjaxPro are not reachable from untrusted networks. Restrict lateral movement paths from IIS servers.
P3 — Within 7 days (by CISA KEV due date 2026-09-09)
- Migrate or decommission: Because AjaxPro is end-of-life/end-of-service with no expected vendor patch, transition affected applications to a supported AJAX framework (e.g., ASP.NET Core, ASP.NET Web API with jQuery/Fetch, or Microsoft AJAX Library if still on .NET Framework). Where migration is not feasible within the window, document a formal risk acceptance with compensating controls (WAF, network isolation, EDR monitoring of
w3wp.exechild process creation). - EDR tuning: Deploy detection rules for anomalous child processes spawned by
w3wp.exe(e.g.,cmd.exe,powershell.exe,certutil.exe) on servers hosting AjaxPro applications — this is the primary behavioural indicator of successful deserialization exploitation.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
Unexpected child process creation from w3wp.exe (e.g., cmd.exe, powershell.exe) |
EDR / Sysmon process creation logs on IIS servers hosting AjaxPro | High — consistent with .NET deserialization RCE |
Inbound POST requests to */ajaxpro/*.ashx endpoints containing large or anomalous serialized payloads |
IIS logs, WAF logs, network IDS | Medium — confirms exploitation attempts |
Unexpected outbound network connections from w3wp.exe process |
EDR / firewall logs | Medium — indicates post-exploitation C2 |
6. Detection
Insufficient indicators to author detection rules.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2021-23758 | 8.1 High | ⚠ KEV 2026-08-26 | 89% | All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization… |
7. Sources
- NVD, "CVE-2021-23758 — Ajax.NET Professional Deserialization of Untrusted Data Vulnerability," https://nvd.nist.gov/vuln/detail/CVE-2021-23758, published 2026-08-25.
- CISA KEV Catalogue, CVE-2021-23758 entry added 2026-08-26, remediation due 2026-09-09.
8. Adverse Trace position
CVE-2021-23758 is a HIGH-severity (CVSS 8.1) deserialization vulnerability in an end-of-life product with confirmed KEV listing and 89% EPSS — the combination of active exploitation, no vendor fix, and RCE impact makes this a priority for EMEA financial services. Any institution with legacy ASP.NET applications must immediately determine whether AjaxPro is present in their stack; those with internet-exposed instances should treat containment as urgent. The absence of a vendor patch means this is fundamentally a migration problem, not a patching problem — risk acceptance without compensating controls is not defensible given the KEV status. Adverse Trace will monitor for published exploit code or threat actor attribution and update clients if specific IOCs or campaign details emerge.
Published via PulseTrace — Adverse Trace threat intelligence.