CVE-2026-13190
HIGH
CVSS 8.1
telerik_ui_for_asp_net_ajax
Verified Advisory
Deserialization Vulnerability in Telerik UI for AJAX (CVE-2026-13190)
In Progress Telerik UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the PersistenceFramework allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.
Affected versions:
- 2011.2.712
- 2026.2.519
We recommend updating to: 2026.2.708.
CVSS 8.1 · our assessment: this_week
Reference: https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-framework-unsafe-type-resolution-CVE-2026-13190
Details: https://vuln.today/cve/CVE-2026-13190
Verified by vuln.today against published advisories.
Affected versions
- – 2011.2.712
- – 2026.2.519
Fixed in: 2026.2.708
More advisories for telerik_ui_for_asp_net_ajax
- CVE-2026-13185 – Telerik UI for AJAX PersistenceFramework Cookie Deserialization Vulnerability (CVE-2026-13185)
- CVE-2026-13186 – Path Traversal and Deserialization in Telerik UI for AJAX (CVE-2026-13186)
- CVE-2026-13182 – RadAsyncUpload Padding Oracle Vulnerability in Telerik UI for AJAX (CVE-2026-13182)