CVE-2026-6023 — Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX

CVE-2026-6023

Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX PUBLISHED

Description (CNA)

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.

Affected (CNA)

Vendor / product	Versions
Progress Software / Telerik UI for ASP.NET AJAX	affected 2024.4.1114 before 2026.1.421

CWE

CWE-502

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-6023

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.