[HIGH PRIORITY] Ajax.NET Professional Deserialization RCE (CVE-2021-23758)

⚠ HIGH PRIORITY — CISA KEV (Aug 26, 2026). CVE-2021-23758 is unsafe deserialization in the Ajax.NET Professional (ajaxpro.2) library. Remote attackers send crafted AJAX requests to /ajaxpro/ endpoints to achieve remote code execution on IIS/ASP.NET Linux and Windows hosts.

Affected applications

• ASP.NET applications referencing AjaxPro.2.dll (all versions)
• IIS sites with /ajaxpro/ handler exposed on port 443/80
• Legacy .NET Framework web apps without WAF protection

Find vulnerable deployments

find /var/www -name 'AjaxPro*.dll' 2>/dev/null
grep -r ajaxpro web.config 2>/dev/null
curl -sk https://site/ajaxpro/ | head -5

Patching Method

1. Inventory all web apps using Ajax.NET Professional library.
2. Remove AjaxPro.2.dll and migrate to modern ASP.NET Core APIs.
3. If removal not immediate: block /ajaxpro/* at IIS URL Rewrite or WAF.
4. Redeploy application without ajaxpro handler registration in web.config.
5. Restart IIS application pool after DLL removal.
6. Scan web root for webshells dropped via deserialization exploit.
7. Rotate app pool identity and database connection strings if compromised.

# IIS — remove handler from web.config
# Block at WAF: deny /ajaxpro/*

Until patched

• Block /ajaxpro/ paths at reverse proxy immediately
• Take legacy app offline if business-critical patch not possible today
• Enable IIS request logging and alert on POST to ajaxpro endpoints

CVSS: 9.8 Critical. No vendor fix — remove or replace the library.