US cyber agency flags old Ajax.NET Professional bug as actively exploited — but details are thin on the ground

A vulnerability in Ajax.NET Professional, a component used to bolt AJAX functionality onto older ASP.NET web applications, has been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue. CISA says the flaw, tracked as CVE-2021-23758, is being actively exploited — not merely theoretical — and has given US federal civilian agencies until 9 September 2026 to apply mitigations.

That’s the headline fact, and it’s a solid one: KEV listings require CISA to have evidence of real-world exploitation before a CVE goes on the list. What’s much less clear from the public record is almost everything else.

What the bug actually does

Here’s the catch. Neither CISA’s catalogue entry nor the linked NVD page, as published, spells out the technical mechanics of the flaw — no confirmed attack vector, no CVSS severity score, no description of what an attacker gains once they’ve exploited it. CISA’s own advice is generic: apply mitigations “in accordance with vendor instructions” and follow its broader BOD 26-04 guidance on prioritising security updates by risk.

That’s thinner than usual for a KEV entry, and it’s worth being upfront about it rather than filling the gaps with speculation. What we can say with confidence is that CVE-2021-23758 was first catalogued back in 2021 — meaning this isn’t a freshly discovered zero-day, but a years-old vulnerability that has evidently resurfaced as a live attack tool, or was quietly being exploited all along before CISA caught up with it.

CISA also lists the ransomware association for this entry as “Unknown”, so there’s no confirmed link to any specific extortion campaign at this stage — just confirmation that someone, somewhere, is using it.

So who is actually at risk

Ajax.NET Professional is not consumer software. It’s a developer library that gets embedded inside older .NET web applications to handle asynchronous page updates — the kind of thing an in-house IT team or a contractor might have bolted onto a bespoke internal site or public-facing portal a decade or more ago. If you’re an ordinary reader, you almost certainly don’t have this installed on your laptop or phone, and there’s no update to click through on a personal device.

The people who need to pay attention are organisations — likely including US federal agencies, given the CISA deadline — still running legacy ASP.NET applications built with this library. Given how old the underlying CVE is, the realistic risk pool is smaller than it once was, but not zero: plenty of ageing internal web tools quietly keep running long after anyone remembers what’s inside them.

What to do about it

If you manage or maintain a website or internal system built with Ajax.NET Professional, the sensible move is to check with whoever supports that codebase, confirm whether a patched version exists, and apply it, or otherwise mitigate exposure per vendor guidance. US federal bodies are required to act by the CISA deadline; everyone else should treat that date as a useful prompt rather than a binding rule.

For most people reading this, the practical takeaway is