CVE-2026-13185
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In Progress Telerik UI for AJAX (prior to v2026.2.708), applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content.
Risk Assessment
An unauthenticated attacker can achieve remote code execution, taking control of the application.
Recommendation
Update Progress Telerik UI for AJAX to version v2026.2.708 or later.
Other vulnerabilities in Progress Telerik UI for AJAX
See all- CVE-2026-6023High
The RadFilter control in Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421 is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client.
- CVE-2026-13190High
A deserialization vulnerability in Progress Telerik UI for AJAX (prior to v2026.2.708) allows unsafe type instantiation from attacker-influenced persisted state.
- CVE-2026-13189High
In Progress Telerik UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
- CVE-2026-13181High
In Progress Telerik UI for AJAX (prior to v2026.2.708), forged upload metadata influences AsyncUploadTypeName processing, enabling unsafe type resolution.
Original NVD description (English source)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.