Ajax.NET Professional code-execution flaw CVE-2021-23758 exploited; fixes depend on the package
Attackers are exploiting an old Ajax.NET Professional flaw on website servers. The official AjaxNetProfessional package has a fix; several other packages do not. Ask your website developer to migrate to official version 24.10.10.1 and check for intruders.
There is no routine phone or browser update for families: this affects website servers. If your business or family office runs a website, ask its developer to replace affected packages with official AjaxNetProfessional 24.10.10.1 and check the server for intruders. Retire affected software if it cannot be safely updated or replaced.
What’s happening
CVE-2021-23758 affects Ajax.NET Professional, a component used by ASP.NET websites. Its handling of incoming data can let a remote attacker run code on the server. Cisco Talos reported exploitation by UAT-10147 on 20 August 2026; the wider campaign targeted organisations including government, universities, media and technology companies. CISA added the flaw to its exploited catalogue six days later. Fix coverage remains partial: the maintainer identifies AjaxNetProfessional 21.11.29.1 as patched but lists no patched versions for AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro. The advisory is internally inconsistent: its affected-version tables say below 21.12.21.1, while its narrative says below 21.11.29.1. The official package's latest release, 24.10.10.1, avoids those disputed boundaries. As at 3 November, exploitation is confirmed, ransomware use is unknown, and the reviewed sources provide no campaign all-clear or AjaxPro-specific victim total.
- What
- Flaw
- Affects
- Ajax.NET Professional (AjaxPro) for ASP.NET website servers
- Affected
- AjaxNetProfessional <21.12.21.1 in the maintainer's table; narrative instead says <21.11.29.1
AjaxPro.2 <21.12.21.1; no patched version listed
Joint.AjaxPro <21.12.21.1; no patched version listed
JointAjax.AjaxPro <21.12.21.1; no patched version listed - Fixed in
- AjaxNetProfessional 21.11.29.1 — maintainer-designated fix, despite conflicting affected-version table
AjaxNetProfessional 24.10.10.1 — latest official release available - Since
- 26 Aug 2026
Timeline
- Update
CISA's 3 November catalogue still includes the flaw and records ransomware use as unknown. This confirms its continuing listing, rather than a newly reported attack.
- CISA added
CISA added CVE-2021-23758 to its Known Exploited Vulnerabilities catalogue, with a 9 September federal remediation deadline. It warned that affected products might be out of support and advised migration or discontinuing use where necessary.
- Wider attacks
Cisco Talos reported that cybercrime group UAT-10147 exploited CVE-2021-23758 among several known server flaws. The wider campaign installed malware for search-result manipulation, data theft and persistent access.
- New fix
The official AjaxNetProfessional package released version 24.10.10.1. This remains the latest release shown on NuGet.
- New fixPartly fixed
Maintainer Michael Schwarz published an advisory naming AjaxNetProfessional 21.11.29.1 as patched. It lists no patched versions for AjaxPro.2, Joint.AjaxPro or JointAjax.AjaxPro.
- Made public
CVE-2021-23758 was published, describing unsafe handling of incoming data in AjaxPro.2 that could let attackers run code remotely.
Sources
- Remote Code Execution Security Vulnerability (CVE-2021-23758)Michael Schwarz · 5 Dec 2021
- AjaxNetProfessional 24.10.10.1Michael Schwarz / NuGet · 10 Oct 2024
- Known Exploited Vulnerabilities catalogue — 3 November 2026 editionCISA · 3 Nov 2026
- UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operationsCisco Talos · 20 Aug 2026
- August 2026 CVE LandscapeRecorded Future · 8 Sept 2026
- U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 28 Aug 2026
- CVE-2021-23758 DetailNIST · 27 Aug 2026