This vulnerability is caused by insecure deserialization of the RadFilter control's state when that state is made available to the client. An attacker can modify the serialized filter data before it is sent back to the server; the server then deserializes the tampered input, which can lead to execution of arbitrary code on the server. The weakness is classified as CWE-502. The impact is a server‑side remote code execution that compromises confidentiality, integrity, and availability of the affected application and any underlying system resources.

Progress Software’s Telerik UI for ASP.NET AJAX products are affected in versions 2024.4.1114 through 2026.1.421. These are the releases that include the RadFilter control vulnerable to tampered client‑exposed state.

The CVSS score of 8.1 indicates a high‑severity vulnerability. The exploit probability is not quantified by EPSS, but the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an attacker to supply crafted filter state data from the client side; therefore, an attacker must be able to inject or modify a request containing the serialized filter state. If successful, remote code execution is possible on the application server.