vulns.cofield index
Enter
Search
LanguageEN
EnglishCurrentEspañolSame sectionPortuguês (Brasil)Same sectionFrançaisSame sectionDeutschSame section日本語Same section简体中文Same section
Learning
Browse all pagesCurrent: Intelligence
Known vulnerability record

CVE-2021-23758

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Stable IDcve:CVE-2021-23758Source record dateHuman reviewNot recordedProvenanceSource-linked CVE, KEV, and EPSS signals
Summary

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

Vulns.co field classification

Code execution on enterprise application

Derived analysis: these labels are inferred from the source title, product, and summary. They are not vendor, CVE, CISA, or FIRST classifications.

Failure classCode execution
Product laneEnterprise application
Attention stateKnown exploited, ransomware use unknown
Hunter pivot

Establish the exact reachable primitive and its preconditions. Use a harmless marker if authorized, preserve a clean control, and stop before persistence, secret access, or lateral movement.

Signals

Keep the signals separate

CVSS severityhighScore 8.1 · source snyk
EPSS probability89.1%Probability of exploitation in the next 30 days; not severity
CISA KEVKnown exploitedAdded 2026-08-26
Ransomware useunknownPreserved as known / unknown, not a truthy default
Research boundary

Confirm the product before the behavior.

  1. Match the exact product, build, deployment mode, and exposed component.
  2. Read the vendor advisory and current program policy.
  3. Choose one non-destructive discriminator with an explicit negative control.
  4. Stop at the first sufficient proof. A CVE match is context, not permission.
Timeline

Dates and provenance

CVE published
2021-12-03
CVE modified
2026-08-27
KEV date added
2026-08-26
Dataset fetched
2026-08-27T13:17:14.532Z
Sources

Original records

Version history: normalized permanent page created 2026-08-20. Machine-enriched fields remain source-attributed.