Critical Actively exploited
CVE-2021-23758
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
What this means
- Weakness
- The application rebuilds an object from attacker-controlled data, which often leads to code execution.
- Likelihood
- Exploitation is not hypothetical: CISA has observed it in the wild.
What to doTop priority: CISA sets the remediation deadline at 9 September 2026.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.