Telerik UI for ASP.NET AJAX CVE-2026-6023

| EUVD-2026-24632 HIGH
Deserialization of Untrusted Data (CWE-502)
2026-04-22 ProgressSoftware GHSA-mcrv-gh25-252c
RCE Deserialization
8.1
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Re-analysis Queued
Apr 22, 2026 - 21:37 vuln.today
cvss_changed
Patch available
Apr 22, 2026 - 09:01 EUVD
Analysis Generated
Apr 22, 2026 - 08:24 vuln.today

DescriptionNVD

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.

AnalysisAI

Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allows unauthenticated remote attackers to execute arbitrary code on the server by tampering with exposed client-side filter state. Affected versions span 2024.4.1114 through 2026.1.421. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Inventory all systems running Progress Telerik UI for ASP.NET AJAX and identify which are running affected versions 2024.4.1114-2026.1.421; disable or restrict network access to RadFilter controls if possible. Within 7 days: Contact Progress Software for patch availability and ETA; implement network segmentation or WAF rules to block malicious filter state payloads targeting RadFilter endpoints. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-6023 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy