A critical deserialization vulnerability in Ajax.NET Professional allows unauthenticated remote code execution and is currently being actively exploited in the wild.

The software fails to safely deserialize untrusted input, allowing the processing of arbitrary .NET classes. An unauthenticated attacker can leverage this flaw to execute arbitrary code on the underlying server.

This vulnerability carries a CVSS score of 9.5, reflecting its critical nature and the potential for total system compromise. Successful exploitation grants an attacker full control over the affected application, leading to unauthorized data access, potential exfiltration of sensitive information, and significant operational downtime. Given its inclusion in the CISA KEV catalog, the urgency for remediation is extremely high to prevent imminent breach.

Immediate Action: Update the AjaxPro.2 package to version 21.11.29.1 or later via NuGet to resolve the deserialization flaw.

Proactive Monitoring: Review application logs for suspicious inbound traffic, particularly requests containing serialized .NET objects or unexpected class references.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter inbound traffic for serialized object signatures, although patching remains the only definitive solution.

Public Exploit Available: Yes, a Metasploit module exists for this vulnerability.

Organizations must treat this vulnerability with the highest level of urgency. Because the flaw is actively exploited and allows for full remote system compromise, all instances of the affected software should be updated immediately to the specified fixed version. If an immediate update is not feasible, consider isolating the affected systems from external network access until the patch can be applied.