Description
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.
Published: 2026-07-22
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A deserialization flaw exists in the PersistenceFramework of Progress Software’s Telerik UI for ASP.NET AJAX before version 2026.2.708, allowing an attacker to influence the persisted state and cause the application to instantiate arbitrary .NET types. This type of weakness is identified as CWE-502 and can enable attackers to execute code on the target system with the permissions of the web application, potentially exposing confidential data, modifying resources, or further compromising the environment.

Affected Systems

The vulnerability affects the Telerik UI for ASP.NET AJAX component of Progress Software. Specifically, versions released prior to 2026.2.708 are impacted. Any deployment or application that incorporates this older component is at risk, regardless of platform, operating system, or hosting environment.

Risk and Exploitability

The CVSS score of 8.1 signals a high severity, indicating that remote exploitation is possible and the impact is large. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, which suggests there are no confirmed exploits in the wild yet; however, deserialization flaws typically attract attackers, making proactive measures advisable.

Generated by OpenCVE AI on August 3, 2026 at 23:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Telerik UI for ASP.NET AJAX update (v2026.2.708 or later) from Progress Software
  • If an upgrade is not immediately possible, restrict deserialization by disabling or restricting the PersistenceFramework feature area, ensuring no untrusted data is deserialized
  • Implement strict input validation and type checking on any persisted data, preventing attacker control over object types in accordance with CWE-502 remediation guidelines

Generated by OpenCVE AI on August 3, 2026 at 23:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Progress
Progress telerik Ui For Asp.net Ajax
Vendors & Products Progress
Progress telerik Ui For Asp.net Ajax

Wed, 22 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Description In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.
Title PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Progress Telerik Ui For Asp.net Ajax
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-07-24T03:56:04.216Z

Reserved: 2026-06-24T13:46:43.300Z

Link: CVE-2026-13190

cve-icon Vulnrichment

Updated: 2026-07-22T19:10:52.538Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:14.667

Modified: 2026-08-06T17:49:14.067

Link: CVE-2026-13190

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:45:06Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data