CVE-2026-6023: Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-22 · updated 2026-10-26
Weakness: CWE-502

Description

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.

Affected products

Progress Software Telerik UI for ASP.NET AJAX: from 2024.4.1114 before 2026.1.421 — fixed in 2026.1.421

How to fix

Upgrade to a fixed version: Progress Software Telerik UI for ASP.NET AJAX 2026.1.421. Check the vendor advisory for mitigations.

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-6023

Get alerted when CVE-2026-6023 or the next vulnerability affects your stack