Ajax.NET Professional Deserialization of Untrusted Data — exploitable from the network with no login

What it is

Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

Why it matters

• CISA added it to the Known Exploited Vulnerabilities catalogue on August 26, 2026 — observed exploitation, on the record.
• EPSS puts the chance of exploitation in the next 30 days at 83.6% — the top 0.3% of all scored CVEs.
• CVSS 9.8 (critical), and it is reachable over the network, needs no credentials, needs no user interaction.

What to do

• Patch it. CISA's due date for federal agencies is September 9, 2026, which is as good a deadline as any for everyone else.
• Check GitHub's advisory for affected versions: https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57

---

Drafted from CVE-2021-23758 — CISA KEV, NVD, FIRST EPSS. Check before publishing.