CVE-2026-6023— Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
Quick assessment
Affected
Progress Software Telerik UI for ASP.NET AJAX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Progress Telerik UI for AJAX是美国Progress公司的一套Web界面组件库。 Progress Telerik UI for AJAX 2024.4.1114至2026.1.421版本存在代码问题漏洞，该漏洞源于RadFilter控件在恢复过滤器状态时存在不安全的反序列化，可能导致服务器端远程代码执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-6023
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Progress Telerik UI for AJAX 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress Telerik UI for AJAX是美国Progress公司的一套Web界面组件库。 Progress Telerik UI for AJAX 2024.4.1114至2026.1.421版本存在代码问题漏洞，该漏洞源于RadFilter控件在恢复过滤器状态时存在不安全的反序列化，可能导致服务器端远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Telerik UI for ASP.NET AJAX | 2024.4.1114 ~ 2026.1.421 | - |
|
II. Public POCs for CVE-2026-6023
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6023
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Telerik UI for ASP.NET AJAX
-
CVE-2026-19219
DialogHandler UploadPaths Tampering Vulnerability in Telerik -
CVE-2026-18672
RadImageEditor ClientState Unauthenticated Arbitrary File Re -
CVE-2026-14932
Unauthenticated File Read and Deletion via Hardcoded Encrypt -
CVE-2026-14865
XXE Denial of Service via RadLayoutBuilder Client State in T -
CVE-2026-13192
RadEditor PDF Export SSRF Vulnerability in Telerik UI for AS
Same vendor: Progress Software
-
CVE-2026-106152
External Control of Configuration Setting in Telerik Report -
CVE-2026-106133
Incorrect Authorization in Telerik Report Server Web Report -
CVE-2026-106137
ClassFactory Race Condition and Retained Assembly Memory in -
CVE-2026-106156
Uncontrolled Resource Consumption in Telerik UI for ASP.NET -
CVE-2026-124694
Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Val
Same weakness: CWE-502
-
CVE-2026-77882
Lenovo System Update 反序列化漏洞致本地提权 -
CVE-2026-71395
Apache XML Graphics FOP: CWE-502 unsafe deserialization in h -
CVE-2026-123374
Apache Roller: Deserialization of untrusted data in weblog u -
CVE-2026-59192
TwigView: Deserialization of Untrusted Data -
CVE-2026-64678
Nitrite: Unfiltered Java Deserialization in Legacy v1 Databa