Protego field desk
PROTEGO
← CVE Lookup

CVE-2021-23758

CRITICALCVSS 3.1 · 9.8 · NIST NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

CISA KEV: known exploited

Added: 2026-08-26 · Due: 2026-09-09

Known ransomware use: Unknown

EPSS: 82.58% · Percentile: 99.7%

As of 2026-10-27

EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.

CWE: CWE-502 · Published: 2021-12-03T20:15:07.557 · Modified: 2026-08-27T04:16:38.863

Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.

All CVSS assessments
  • CVSS 3.1: 9.8 (CRITICAL) · NIST NVD
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVSS 3.1: 8.1 (HIGH) · report@snyk.io
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVSS 2.0: 7.5 (HIGH) · NIST NVD
    AV:N/AC:L/Au:N/C:P/I:P/A:P

References and fixes