CVE-2026-13190
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A deserialization vulnerability in Progress Telerik UI for AJAX (prior to v2026.2.708) allows unsafe type instantiation from attacker-influenced persisted state.
Risk Assessment
This can lead to remote code execution, giving the attacker full control over the application.
Recommendation
Update Progress Telerik UI for AJAX to version v2026.2.708 or later.
Other vulnerabilities in Progress Telerik UI for AJAX
See all- CVE-2026-6023High
The RadFilter control in Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421 is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client.
- CVE-2026-13189High
In Progress Telerik UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
- CVE-2026-13185High
In Progress Telerik UI for AJAX (prior to v2026.2.708), applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content.
- CVE-2026-13181High
In Progress Telerik UI for AJAX (prior to v2026.2.708), forged upload metadata influences AsyncUploadTypeName processing, enabling unsafe type resolution.
Original NVD description (English source)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.