What is the CVSS score of CVE-2026-6023?

CVE-2026-6023 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Telerik UI for ASP.NET AJAX are affected by CVE-2026-6023?

Progress Telerik UI for ASP.NET AJAX versions 2024.4.1114 through 2026.1.421 contain a critical remote code execution vulnerability in the RadFilter control that allows unauthenticated attackers to…. A patch is available.

How to fix or mitigate CVE-2026-6023?

Within 24 hours: Inventory all systems running Progress Telerik UI for ASP.NET AJAX and identify which are running affected versions 2024.4.1114-2026.1.421; disable or restrict network access to RadFilter controls if possible. Within 7 days: Contact Progress Software for patch availability and ETA; implement network segmentation or WAF rules to block malicious filter state payloads targeting RadFilter endpoints. Within 30 days: Apply vendor-released patch immediately upon availability; if patch remains unavailable, complete migration to unaffected versions or implement compensating controls.

Telerik UI for ASP.NET AJAX CVE-2026-6023

EUVD-2026-24632 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-04-22 ProgressSoftware

GHSA-mcrv-gh25-252c

Deserialization RCE Telerik Ui For Asp Net Ajax

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Patch released

Apr 22, 2026 - 21:23 nvd

Patch available

Apr 22, 2026 - 09:01 EUVD

Analysis Generated

Apr 22, 2026 - 08:24 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:00 euvd

EUVD-2026-24632

Analysis Generated

Apr 22, 2026 - 08:00 vuln.today

CVE Published

Apr 22, 2026 - 07:13 nvd

HIGH 8.1

DescriptionCVE.org

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.

AnalysisAI

Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allows unauthenticated remote attackers to execute arbitrary code on the server by tampering with exposed client-side filter state. Affected versions span 2024.4.1114 through 2026.1.421. EPSS data not available; no public exploit or CISA KEV listing identified at time of analysis. The CVSS 8.1 (High) reflects network accessibility but 'High' attack complexity (AC:H), indicating successful exploitation requires specific conditions beyond simple network access.

Technical ContextAI

The vulnerability resides in the RadFilter control within Progress Telerik UI for ASP.NET AJAX, a component framework for building web applications on the .NET platform. RadFilter provides dynamic query-building capabilities and persists filter state between requests. The flaw (CWE-502: Deserialization of Untrusted Data) occurs when this filter state is serialized and exposed to the client-typically in ViewState, hidden form fields, or query parameters. ASP.NET's BinaryFormatter or other .NET deserialization mechanisms can instantiate arbitrary objects when processing untrusted state data. An attacker who controls serialized input can craft malicious payloads (using gadget chains in libraries like System.Configuration or System.Windows.Data.ObjectDataProvider) to achieve code execution upon deserialization. The CPE cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax identifies the affected library across multiple product versions. This vulnerability pattern is well-established in .NET ecosystems, particularly in products exposing serialized state to untrusted clients.

RemediationAI

Upgrade to Progress Telerik UI for ASP.NET AJAX version 2026.2.513 or later, which addresses the deserialization vulnerability in RadFilter state handling per vendor advisory available at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-6023. If immediate patching is not feasible, implement the following compensating controls: (1) disable client-side state persistence for RadFilter controls by setting StateStorageMode to server-side only (stores state in server session rather than ViewState)-trade-off is increased server memory consumption and incompatibility with web farms without sticky sessions; (2) encrypt and sign ViewState using machineKey with validation='AES' and decryption='AES' in web.config, ensuring attackers cannot tamper with serialized data-this mitigates but does not eliminate risk if encryption keys are compromised; (3) implement network segmentation to restrict access to applications using RadFilter to trusted IP ranges only-reduces attack surface but does not prevent authenticated or insider threats. Note that generic input validation is insufficient as exploitation occurs at the deserialization layer before application logic processes data. Vendor advisory provides code samples for secure configuration; review deployment-specific guidance before applying mitigations.