What is the CVSS score of CVE-2026-13185?

CVE-2026-13185 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Telerik UI are affected by CVE-2026-13185?

Progress Telerik UI for ASP.NET AJAX versions prior to 2026.2.708 contain a remote code execution vulnerability enabling unauthenticated attackers to execute arbitrary code on affected servers…. A patch is available.

How to fix or mitigate CVE-2026-13185?

Within 24 hours, identify and catalog all instances of Progress Telerik UI for ASP.NET AJAX in production and assess network exposure to untrusted sources. Within 7 days, implement interim mitigations including disabling RadPersistenceManager and RadDockLayout components where operationally feasible, deploying Web Application Firewall rules to block .NET serialized object payloads in cookies, and restricting network access to affected applications. Within 30 days, monitor Progress vendor advisories for patch release targeting version 2026.2.708 or later and prepare staged testing and deployment.

Telerik UI CVE-2026-13185

EUVD-2026-47690 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-22 ProgressSoftware

GHSA-j72w-hfj3-hj2x

RCE Deserialization Telerik Ui For Asp Net Ajax Progress Software

8.1

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but AC:H because a valid protection-bypassing serialized payload is required; deserialization RCE yields full C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:32 vuln.today

CVE Published

Jul 22, 2026 - 13:38 cve.org

HIGH 8.1

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.

AnalysisAI

Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state via cookie-based storage in RadPersistenceManager or RadDockLayout, causing the components to deserialize attacker-supplied cookie payloads. An unauthenticated remote attacker who can reach the application and craft a malicious serialized cookie can achieve code execution on the server. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Telerik UI for ASP.NET AJAX is a large suite of server-side web UI controls embedded in .NET web applications. Two of its state-persistence features - RadPersistenceManager (which saves control state) and RadDockLayout (which persists dock/panel layout) - can be configured to store their serialized state in browser cookies. The root cause is CWE-502 (Deserialization of Untrusted Data): when these controls read cookie content back, they deserialize it without adequately validating or restricting the object types, so a forged cookie can drive .NET object instantiation into a gadget chain. This class of flaw has historically plagued Telerik (e.g. prior RadAsyncUpload deserialization RCEs). Per the CPE, the affected component is cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax.

RemediationAI

Vendor-released patch: v2026.2.708 - upgrade Telerik UI for ASP.NET AJAX to v2026.2.708 or later, which is the primary and authoritative fix, and rebuild/redeploy affected .NET applications with the updated Telerik.Web.UI assembly. If immediate upgrade is not possible, reconfigure RadPersistenceManager and RadDockLayout to avoid cookie-based storage (use server-side or database-backed persistence instead), which removes the untrusted deserialization path but may change how control state is retained across requests. As an additional compensating control, ensure any Telerik state-encryption keys are strong, unique, and not the framework defaults, and restrict/monitor access to the affected endpoints. Refer to the vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-cookie-deserialization-CVE-2026-13185 for exact configuration guidance.