Oh. AJAX. AJAX is just JavaScript internally GETting (or POSTing to) a URL. The data returned need not look like a web page; JSON is a common format, but far from the only one. Security (of who can access that URL) can be handled by standard methods, or by you. Cookies or tokens generated after a login are common methods. Cookies are read by the HTTP_COOKIE environment variable, or, hopefully, your C/C++ CGI library. Regarding the security I mentioned earlier, if you have a C/C++ CGI library, it's probably sanitizing most of your data well enough.
You act like you want AJAX to communicate with a C/C++ executable that might already be running in the background. Is that the case? CGI starts brief, little, inherently-stateless processes. If you want to communicate with another process, you need to set up inter-process communication (IPC) yourself. A very basic method would be simple files that are watched for. What's available depends on your server's OS.