Critical severity · published Apr 22, 2026
CVE-2026-6023
Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Telerik UI for ASP.NET AJAX · Progress Software
2024.4.1114 before 2026.1.421 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6023
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6023
Mitigation
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-6023
More from Telerik UI for ASP.NET AJAX
8.1
CVE-2026-19219
DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13190
PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13187
DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13186
AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13185
PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX