CVE-2026-6023

Published: Apr 22, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.

Affected (1)

Products: Progress: Telerik Ui For Asp.net Ajax

1 product

Telerik Ui For Asp.net Ajax

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Progress Telerik Ui For Asp.net Ajax	From 2024.4.1114 to 2026.1.421

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (1)

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-6023

Source: security@progress.com

MitigationVendor Advisory

Timeline

No history available yet.