{"id":"ajaxpro-deserialisation-attacks-aug-2026","category":"patch","status":"live","title":"Ajax.NET Professional code-execution flaw CVE-2021-23758 exploited; fixes depend on the package","tldr":"Attackers are exploiting an old Ajax.NET Professional flaw on website servers. The official AjaxNetProfessional package has a fix; several other packages do not. Ask your website developer to migrate to official version 24.10.10.1 and check for intruders.","summary":"CVE-2021-23758 affects Ajax.NET Professional, a component used by ASP.NET websites. Its handling of incoming data can let a remote attacker run code on the server. Cisco Talos reported exploitation by UAT-10147 on 20 August 2026; the wider campaign targeted organisations including government, universities, media and technology companies. CISA added the flaw to its exploited catalogue six days later. Fix coverage remains partial: the maintainer identifies AjaxNetProfessional 21.11.29.1 as patched but lists no patched versions for AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro. The advisory is internally inconsistent: its affected-version tables say below 21.12.21.1, while its narrative says below 21.11.29.1. The official package's latest release, 24.10.10.1, avoids those disputed boundaries. As at 3 November, exploitation is confirmed, ransomware use is unknown, and the reviewed sources provide no campaign all-clear or AjaxPro-specific victim total.","action":"There is no routine phone or browser update for families: this affects website servers. If your business or family office runs a website, ask its developer to replace affected packages with official AjaxNetProfessional 24.10.10.1 and check the server for intruders. Retire affected software if it cannot be safely updated or replaced.","product":"Ajax.NET Professional (AjaxPro) for ASP.NET website servers","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2021-23758"],"tags":["ajaxpro","aspnet","windows","server","deserialisation","remote-code-execution"],"affected":["AjaxNetProfessional <21.12.21.1 in the maintainer's table; narrative instead says <21.11.29.1","AjaxPro.2 <21.12.21.1; no patched version listed","Joint.AjaxPro <21.12.21.1; no patched version listed","JointAjax.AjaxPro <21.12.21.1; no patched version listed"],"fixed":["AjaxNetProfessional 21.11.29.1 — maintainer-designated fix, despite conflicting affected-version table","AjaxNetProfessional 24.10.10.1 — latest official release available"],"matches":[],"sources":[{"kind":"advisory","title":"Remote Code Execution Security Vulnerability (CVE-2021-23758)","url":"https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-6r7c-6w96-8pvw","by":"Michael Schwarz","date":"2021-12-05"},{"kind":"advisory","title":"AjaxNetProfessional 24.10.10.1","url":"https://www.nuget.org/packages/AjaxNetProfessional/","by":"Michael Schwarz / NuGet","date":"2024-10-10"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue — 3 November 2026 edition","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"research","title":"UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations","url":"https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/","by":"Cisco Talos","date":"2026-08-20"},{"kind":"research","title":"August 2026 CVE Landscape","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","by":"Recorded Future","date":"2026-09-08"},{"kind":"news","title":"U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/197975/hacking/u-s-cisa-adds-red-hat-linux-kernel-ajax-net-professional-microsoft-sql-server-and-citrix-netscaler-flaws-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","date":"2026-08-28"},{"kind":"advisory","title":"CVE-2021-23758 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2021-23758","by":"NIST","date":"2026-08-27"}],"started":"2026-08-26","closed":null,"created":"2026-11-03T22:14:05.181Z","updated":"2026-11-03T22:14:05.181Z","cve_notes":[{"cve":"CVE-2021-23758","name":"Unsafe deserialisation in Ajax.NET Professional","what":"Ajax.NET Professional can turn untrusted incoming data into arbitrary .NET objects, allowing a remote attacker to run code on the website server.","severity":"high","cvss":0}],"timeline":[{"at":"2026-11-03","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"CISA's 3 November catalogue still includes the flaw and records ransomware use as unknown. This confirms its continuing listing, rather than a newly reported attack.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-08-26","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2021-23758 to its Known Exploited Vulnerabilities catalogue, with a 9 September federal remediation deadline. It warned that affected products might be out of support and advised migration or discontinuing use where necessary.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-08-20","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Cisco Talos reported that cybercrime group UAT-10147 exploited CVE-2021-23758 among several known server flaws. The wider campaign installed malware for search-result manipulation, data theft and persistent access.","url":"https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/","by":"Cisco Talos","patch":null},{"at":"2024-10-10","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"The official AjaxNetProfessional package released version 24.10.10.1. This remains the latest release shown on NuGet.","url":"https://www.nuget.org/packages/AjaxNetProfessional/","by":"Michael Schwarz / NuGet","patch":null},{"at":"2021-12-05","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Maintainer Michael Schwarz published an advisory naming AjaxNetProfessional 21.11.29.1 as patched. It lists no patched versions for AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro.","url":"https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-6r7c-6w96-8pvw","by":"Michael Schwarz","patch":"partial"},{"at":"2021-12-03","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"CVE-2021-23758 was published, describing unsafe handling of incoming data in AjaxPro.2 that could let attackers run code remotely.","url":"https://nvd.nist.gov/vuln/detail/cve-2021-23758","by":"NIST","patch":null}],"url":"https://hard.fyi/live/ajaxpro-deserialisation-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=ajaxpro-deserialisation-attacks-aug-2026"}