CVE-2026-6023

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-6023	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En las versiones 2024.4.1114 a 2026.1.421 de Progress® Telerik® UI for AJAX, el control RadFilter es vulnerable a la deserialización insegura al restaurar el estado del filtro si el estado está expuesto al cliente. Si un atacante manipula este estado, es posible una ejecución remota de código del lado del servidor.

Information

Published : 2026-04-22 08:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-6023

Mitre link : CVE-2026-6023

CVE.ORG link : CVE-2026-6023

JSON object : View

Products Affected

progress

telerik_ui_for_asp.net_ajax

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-6023", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6023", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Telerik UI for ASP.NET AJAX", "versions": [{"status": "affected", "version": "2024.4.1114", "lessThan": "2026.1.421", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-22T08:16:13.040", "references": [{"url": "https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-6023", "tags": ["Mitigation", "Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible."}, {"lang": "es", "value": "En las versiones 2024.4.1114 a 2026.1.421 de Progress\u00ae Telerik\u00ae UI for AJAX, el control RadFilter es vulnerable a la deserializaci\u00f3n insegura al restaurar el estado del filtro si el estado est\u00e1 expuesto al cliente. Si un atacante manipula este estado, es posible una ejecuci\u00f3n remota de c\u00f3digo del lado del servidor."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B012BE59-AF83-4A7E-A693-11B6E0ACB2C2", "versionEndExcluding": "2026.1.421", "versionStartIncluding": "2024.4.1114"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}