Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-23758

CVE-2021-23758CRITICAL

n/a AjaxPro.2 — Deserialization of Untrusted Data

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .8258   99.7   YES

AFFECTED
  Product    Versions     Fixed
  AjaxPro.2  unspecified  —

TIMELINE
  Jan 8   Reserved by snyk
  Dec 3   Published (CNA: snyk)
  Aug 26  ADDED TO KEV — CVE-2021-23758 (AjaxPro.2). Remediation due September 9, 2026.
  Aug 27  EXPLOIT PUBLISHED — CVE-2021-23758 (AjaxPro.2). Public exploit reference added.
  Aug 27  RESCORED — CVE-2021-23758 (AjaxPro.2). CVSS 8.1 → 9.8 (NVD).
  Sep 10  DUE DATE PASSED — CVE-2021-23758 (AjaxPro.2). CISA remediation deadline was September 9, 2026; still in catalog.

CWE-502 · CNA: snyk · CVSS v3.1 · 5 references · NVD status: Analyzed · KEV due September 9, 2026

Description

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

Lifecycle

Complete event history — 6 events, chronological
Date	Event	Detail
January 8, 2021	Reserved	Reserved by snyk
December 3, 2021	Published	Published (CNA: snyk)
August 26, 2026	KEV ADDED	ADDED TO KEV — CVE-2021-23758 (AjaxPro.2). Remediation due September 9, 2026.
August 27, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2021-23758 (AjaxPro.2). Public exploit reference added.
August 27, 2026	RESCORED	RESCORED — CVE-2021-23758 (AjaxPro.2). CVSS 8.1 → 9.8 (NVD).
September 10, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2021-23758 (AjaxPro.2). CISA remediation deadline was September 9, 2026; still in catalog.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	AjaxPro.2	—	—	—

Weaknesses

CWE-502

References (5)

http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html [Exploit, VDB Entry]
https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ [Exploit, Third Party Advisory]
https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 [Patch, Third Party Advisory]
https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971 [Third Party Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758 [US Government Resource]

Authoritative record: CVE-2021-23758 at cve.org

Weaknesses: CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-23758 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.