{"vulnerability": "cve-2021-23758", "sightings": [{"uuid": "f65e0cc7-d854-4850-97b7-c7865b2ea987", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "MISP/30cbf1e5-40c5-456e-b63a-f5298da02bf0", "content": "", "creation_timestamp": "2023-01-28T20:13:34.000000Z"}, {"uuid": "120db7e5-e5d2-44f6-8ea4-2f2722c8bc09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "8eafa269-d253-4cbb-8625-2309e1651162", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:35.000000Z"}, {"uuid": "38d9bc3b-9d70-4600-a4c3-58685195fc11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ajaxpro_deserialization_rce.rb", "content": "", "creation_timestamp": "2023-11-02T18:27:53.000000Z"}, {"uuid": "3ca2912a-2e5f-4607-bb36-723c5f6b9c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:59.000000Z"}, {"uuid": "0a6f8402-bb9d-457f-800b-d38068670a02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8425", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-23758 AjaxPro.NET deserialization.\n\nhttps://mp.weixin.qq.com/s/7y-iyMMZAoN4B2dGvCFvXg", "creation_timestamp": "2021-12-15T22:01:22.000000Z"}, {"uuid": "7a99e0c1-3cfd-498a-b840-3ab139534361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://t.me/cibsecurity/33334", "content": "\u203c CVE-2021-23758 \u203c\n\nAll versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-03T22:38:06.000000Z"}, {"uuid": "1944cc33-c33f-4954-83c6-e38ded29f473", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1486", "content": "#exploit\n1. CVE-2021-23758:\nAjaxPro .NET - deserialization/RCE vulnerability\nhttps://mp.weixin.qq.com/s/7y-iyMMZAoN4B2dGvCFvXg\n\n2. CVE-2021-25467: \nKernel LPE in the Vision DSP Kernel Driver\nhttps://labs.taszk.io/blog/post/62_ss_dsp_oob_write\n\n3. CVE-2021-30990:\nBypassing macOS Gatekeeper\nhttps://ronmasas.com/posts/bypass-macos-gatekeeper\n\n@BlueRedTeam", "creation_timestamp": "2021-12-16T06:45:25.000000Z"}, {"uuid": "e626d6ee-9525-423d-b80b-71c655d7b164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4985", "content": "#exploit\n1. CVE-2021-23758:\nAjaxPro .NET - deserialization/RCE vulnerability\nhttps://mp.weixin.qq.com/s/7y-iyMMZAoN4B2dGvCFvXg\n\n2. CVE-2021-25467: \nKernel LPE in the Vision DSP Kernel Driver\nhttps://labs.taszk.io/blog/post/62_ss_dsp_oob_write\n\n3. CVE-2021-30990:\nBypassing macOS Gatekeeper\nhttps://ronmasas.com/posts/bypass-macos-gatekeeper", "creation_timestamp": "2021-12-16T12:39:02.000000Z"}, {"uuid": "bed9626f-e1f4-4d6f-90d0-8faed0575675", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5229", "content": "#Threat_Research\n1. Zooming in on Zero-click Exploits\n(against the Windows Zoom client)\nhttps://googleprojectzero.blogspot.com/2022/01/zooming-in-on-zero-click-exploits.html\n2. RCE in Ajax NET Professional:\nVulnerability/exploitation details for CVE-2021-23758\nhttps://mogwailabs.de/en/blog/2022/01/vulnerability-spotlight-rce-in-ajax.net-professional", "creation_timestamp": "2022-01-19T11:01:01.000000Z"}, {"uuid": "c2f8caad-bc87-4768-bdae-e5c3abe16636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://t.me/club31337/1360", "content": "Acunetix v15.2 - 13 Dec 2022 LINUX\n\nDownload: https://mega.nz/file/vkkHTK6R#Rszpm8d08Mes5hHc1lVHfIH5BdOCf5z73mg6o00s1QU\nPassword: Pwn3rzs\n\nSetup + instructions are inside the archive, just read the README.txt file :)\n\nEnjoy!\n\nChangelog:\n\nNEW SECURITY CHECKS\nUpdated the WordPress plugin vulnerabilities.\nAdded the AjaxPro.NET Professional Deserialization RCE (CVE-2021-23758).\nImproved the out-of-band detection.\n\nIMPROVEMENTS\nAdded ability to send HTTP requests to pre-request scripts.\nVarious DeepScan improvements, generally improving the processing of JavaScript-rich web applications.\nUpdated the embedded Chromium browser to v108.0.5359.71.\nImplemented the scan id to limit the caching, such as file list and libraries, to a scan.\nImproved the performance of alert transmission for AcuSensor.\n\nFIXES\nFixed the MongoDB injection and removed JSON parsing from the feature extraction library to avoid scan crashes.\nFixed the issue that sent bogus report because of inconsistent last scan id.\nImproved the Pre-request script to send an HTTP job.\nFixed the formatting issue for vulnerabilities exported to GitHub Issues.\nFixed the unhandled exception that the IAST Bridge throws.\nFixed the business logic recorder issue that failed to replay the logic sequence recorder.\nFixed the issue that the custom scripts folder was not created during the installation.\nFixed the issue that failed to show the Chinese on some headings when switched to Chinese.\nFixed the manual intervention required information box that began to appear in the notification bar instead of being displayed as a dialog box.\nAdded cURL as a backup if NSLookup is not present.\nFixed the Jira integration that failed to create the epic issues.\nFixed the issue that long scan names overlap with the AcuSensor icon.\nFixed the issue that the authorization bearer was not used throughout the scan.", "creation_timestamp": "2024-11-11T00:20:21.000000Z"}, {"uuid": "69d0f1a7-475e-4c8e-9d60-d31d8cf6a7ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mueh6cftmy2q", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-08-31T08:06:46.711958Z"}, {"uuid": "c8770f59-8d1d-47ea-9d86-92953c96314a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mtyuwryaay2k", "content": "\ud83d\uded1 CVE-2021-23758\nAjax.NET Professional Ajax.NET Professional\nCVSS 8.1 / EPSS 89% / KEV: No\nTL;DR: All versions of package ajaxpro.2 are vulnerable to Deserializ\u2026\nhttps://cvesentinel.com/report/CVE-2021-23758?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-26T17:41:10.076670Z"}, {"uuid": "035538c1-f4ae-4158-9e16-bd2f625cc5c6", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a6478612-57d7-4215-ae14-6e1cb7e92f74", "content": "", "creation_timestamp": "2026-08-26T18:00:02.266302Z"}, {"uuid": "822fae0f-ac8d-4a0c-8f41-93ece17c1191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mtyvypgeka2h", "content": "\ud83d\udea8 Critical Threat Intel: CVE-2021-23758 impacts Ajax.NET Professional via unsafe object deserialization, enabling remote code execution. Review exploit deployment mechanisms, process telemetry, and active hardening actions. Read the full TSUITE brief: https://thecycbermind.co/jily", "creation_timestamp": "2026-08-26T18:00:08.975187Z"}, {"uuid": "b22e0ec9-bf05-4ae9-8599-46bc614f2ddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mtz2gb6jp52w", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-23758: All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserial\u2026\nCVSS 8.1 \u00b7 EPSS 89.1% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-23758\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-26T19:19:18.279767Z"}, {"uuid": "b89809d9-4211-406f-9f0f-903799db5712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mtzefi2rys2j", "content": "\ud83d\udea8 CISA Adds 6 KEV to Catalog\n\n\ud83d\udd34 CVE-2015-3246 Red Hat Libuser\n\ud83d\udfe0 CVE-2015-5287 Red Hat Automatic Bug Reporting Tool\n\ud83d\udd34 CVE-2019-1068 MS SQL Server\n\ud83d\udd34 CVE-2021-23758 Ajax.NET Professional\n\ud83d\udd34 CVE-2022-0995 Linux Kernel\n\ud83d\udd34 CVE-2026-8452 Citrix NetScaler ADC & NetScaler GW\n\nsecdb.nttzen.cloud/security-adv...", "creation_timestamp": "2026-08-26T22:17:50.323468Z"}, {"uuid": "b36c69a4-b6fc-472b-aec8-137971f685de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mtziquesvy2r", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2021-23758: Ajax.NET Professional Deserialization of Untrusted Data Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2021-23758", "creation_timestamp": "2026-08-26T23:35:46.238014Z"}, {"uuid": "f8cdf766-659d-4736-b295-37f4ac3d33b4", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3b82890a-b32d-4df3-a18a-7bef29f093cb", "content": "", "creation_timestamp": "2026-08-27T18:00:35.027881Z"}, {"uuid": "75eb2a25-e282-443c-bb04-a43fdfa32d96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mu27wpzuqh2r", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2021-23758: \u26a0\ufe0f CVE-2021-23758: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 89.1%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2021-23758-all-versions-of-package-ajaxpro2-are", "creation_timestamp": "2026-08-27T06:30:38.855420Z"}, {"uuid": "4da70fd1-f3cd-4139-acab-1e7f6fa497f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mu2dm4efnm2h", "content": "\ud83d\udea8 Executive Risk Brief: CVE-2021-23758 targets Ajax.NET Professional via unsafe deserialization. Leaders must review SBOM asset visibility, regulatory compliance, and financial risk mitigation strategies. Read the full CSUITE brief: https://thecybermind.co/uyx4", "creation_timestamp": "2026-08-27T07:36:18.534307Z"}, {"uuid": "bcac4a3f-50f8-496c-9ad2-0db3567e5ea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3muw2kwoiqt25", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-09-07T08:09:07.306547Z"}, {"uuid": "25434cb5-0c8f-4e8e-9236-32a4c51add68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ajaxpro_deserialization_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Hans-Martin M\\u00fcnch (MOGWAI LABS)\", \"Jemmy Wang\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module leverages an insecure deserialization of data to get\\n          remote code execution on the target OS in the context of the user\\n          running the website which utilized AjaxPro.\\n\\n          To achieve code execution, the module will construct some JSON data\\n          which will be sent to the target. This data will be deserialized by\\n          the AjaxPro JsonDeserializer and will trigger the execution of the\\n          payload.\\n\\n          All AjaxPro versions prior to 21.10.30.1 are vulnerable to this\\n          issue, and a vulnerable method which can be used to trigger the\\n          deserialization exists in the default AjaxPro namespace.\\n\\n          AjaxPro 21.10.30.1 removed the vulnerable method, but if a custom\\n          method that accepts a parameter of type that is assignable from\\n          `ObjectDataProvider` (e.g. `object`) exists, the vulnerability can\\n          still be exploited.\\n\\n          This module has been tested successfully against official AjaxPro on\\n          version 7.7.31.1 without any modification, and on version 21.10.30.1\\n          with a custom vulnerable method added.\", \"disclosure_date\": \"2021-12-03\", \"fullname\": \"exploit/windows/http/ajaxpro_deserialization_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"AjaxPro Deserialization Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"screen-effects\", \"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/ajaxpro_deserialization_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/ajaxpro_deserialization_rce\", \"references\": [\"CVE-2021-23758\", \"URL-https://mogwailabs.de/en/blog/2022/01/vulnerability-spotlight-rce-in-ajax.net-professional/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Windows Command\", \"Windows Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:41.714259Z"}, {"uuid": "f874f0c7-45aa-429c-9972-ea00ca4c4ec6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mvhnrkgzst26", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-09-14T08:08:06.091434Z"}, {"uuid": "cdd79c35-a27a-4238-a48e-ee691d3ab11d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23758", "type": "seen", "source": "https://t.me/VulnerabilityNews/44179", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2015-3246 Red Hat Libuser Race Condition Vulnerability\nCVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability\nCVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability\nCVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability\nCVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability\nCVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-18T12:00:06.436614Z"}]}