What is the CVSS score of CVE-2026-13190?

CVE-2026-13190 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Telerik UI for AJAX are affected by CVE-2026-13190?

Progress Telerik UI for ASP.NET AJAX versions prior to 2026.2.708 contain a remote code execution vulnerability in the persistence framework that could allow network attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-13190?

Within 24 hours, identify all systems running Progress Telerik UI for ASP.NET AJAX, determine which are running versions prior to 2026.2.708, and implement network segmentation or access restrictions on affected applications. Within 7 days, subscribe to Progress/Telerik security bulletins for patch availability, apply web application firewall (WAF) rules to restrict unauthorized access to persistence framework components, and deploy version 2026.2.708 or later immediately when available; enable detailed logging of deserialization operations and persistence-layer activity. Within 30 days, verify patch deployment is complete across all affected systems and conduct a security assessment to identify any past exploitation attempts.

Telerik UI for AJAX CVE-2026-13190

EUVD-2026-47696 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-22 ProgressSoftware

GHSA-p8j7-r543-2gf8

RCE Deserialization Telerik Ui For Asp Net Ajax Progress Software

8.1

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because the attacker must shape attacker-influenced persisted state into a viable gadget; successful deserialization yields full RCE, so C/I/A are High.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:34 vuln.today

CVE Published

Jul 22, 2026 - 13:43 cve.org

HIGH 8.1

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

AnalysisAI

Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resolution in the persistence framework, where attacker-influenced persisted state is deserialized into arbitrary object types. Network-reachable attackers can leverage this to run arbitrary code on the hosting web server, though the CVSS High attack complexity (AC:H) indicates exploitation depends on influencing persisted state rather than a trivial single request. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the deserialization class and product history warrant urgent patching.

Technical ContextAI

The affected component is Progress Telerik UI for ASP.NET AJAX (CPE cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax), a widely used suite of server-side web UI controls for .NET web applications. The root cause is CWE-502 (Deserialization of Untrusted Data): the persistence utilities that serialize and restore control/component state resolve and instantiate .NET types from serialized input without restricting them to a safe allow-list. When the type name embedded in persisted state can be influenced by an attacker, the framework instantiates unexpected types, enabling classic .NET deserialization gadget-chain abuse. This mirrors the well-known deserialization weaknesses historically found in Telerik (e.g., RadAsyncUpload) where unsafe type resolution converts stored state into a code-execution primitive.

RemediationAI

Vendor-released patch: v2026.2.708 - upgrade Telerik UI for ASP.NET AJAX to v2026.2.708 or later and redeploy the affected .NET web applications, following the vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-framework-unsafe-type-resolution-CVE-2026-13190. Until the upgrade is applied, restrict network exposure of the affected application (place it behind authenticated access or a WAF and block untrusted requests to endpoints that submit or restore control state), which reduces reachability at the cost of usability for legitimate external users; where the vendor documents type-allow-list or configuration hardening for the persistence framework, apply it, understanding that overly strict allow-lists can break controls that legitimately serialize custom types. Because deserialization gadgets often reuse assemblies present on the server, also review and minimize unnecessary libraries in the web application's bin directory.