CVE-2021-23758

This flaw is like leaving a “mailbox” on your server that accepts a special kind of message and then runs what’s inside it. If an attacker can reach your server, they can craft messages that let them run code as if they were part of your application. That can lead to total control of the server and whatever data or systems it can access.

This matters if you run a small business website or internal app that includes AjaxNetProfessional (including AjaxPro.2 / ajax.net professional) and is reachable from the network. Because the vulnerability does not require a login and has no user action, the main question is whether your server is publicly reachable and uses a vulnerable version that processes untrusted input. The risk is highest when the vulnerable component is deployed and reachable over the network.

This is RED because real-world exploitation is confirmed in CISA KEV, meaning attackers are actively targeting systems like yours. It is also reachable in default configuration and does not require authentication, so there’s a direct, low-friction path from internet access to full server compromise.

Confirm whether we’re exposed

1. Identify where AjaxNetProfessional/AjaxPro.2 (ajax.net professional) is used (web app, service, or shared library) and record the exact version(s) in production.
2. Confirm whether the affected application endpoint(s) are reachable from the network (public internet, VPN-exposed services, or any externally reachable address).
3. Check recent server access logs around the time of any changes or suspicious activity for unusual inbound requests targeting Ajax-related endpoints/payloads (exact indicators may vary by deployment).

Upgrade to the fixed versions

4. If you use ajaxnetprofessional, upgrade to 21.11.29.1.
5. If you use ajax.net professional, upgrade to 21.10.30.1.
6. If you use AjaxPro.2, the findings provided do not list a fixed version; obtain the vendor’s patched version guidance and upgrade accordingly.

Re-test / verify after upgrading

7. After the upgrade, re-verify:
   • The deployed application is actually running the upgraded component version.
   • The externally reachable surfaces still function normally.
   • There are no new errors and no evidence of continued malicious probing.

If you cannot patch immediately (temporary containment)

8. If a patch cannot be applied right away, reduce exposure immediately by restricting network access to the affected web/app to only necessary IP ranges (or internal networks), and monitor for attempted access from untrusted sources.
9. If restrictions are not feasible, plan for immediate shutdown/disablement of the externally reachable service that uses the vulnerable component until the fixed version is deployed.

KEV deadline

10. CISA KEV remediation due date for this issue is 2026-09-09. Prioritize remediation in line with CISA guidance for internet-exposed assets.

What to monitor next

11. Continued scanning attempts or exploit-like payloads in web/app logs.
12. Any signs of persistence or post-compromise behavior (new scheduled tasks/services, unexpected outbound connections, new admin accounts), since successful deserialization can lead to arbitrary code execution.

CVE-2021-23758 is a CWE-502 issue where the application deserializes untrusted data from the network. The findings state an attacker can remotely trigger execution of arbitrary code, with no authentication and no user interaction, and it is reachable in default configuration. The vulnerability is listed in CISA KEV, with a CISA remediation due date of 2026-09-09, indicating confirmed real-world exploitation. A public exploit is reported as available, and exploitation has been associated with an actor label (UAT-10147) in the provided pulse data. The patch information in the findings specifies fixed versions for ajaxnetprofessional (21.11.29.1) and ajax.net professional (21.10.30.1), while a fixed version for AjaxPro.2 is not specified in the provided data.