CVE-2026-6023

published 2026-04-22

CVE-2026-6023: In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring…

Priority P2 66 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
progress	telerik_ui_for_asp.net_ajax	>= 2024.4.1114 < 2026.1.421	2026.1.421
progress_software	telerik_ui_for_asp.net_ajax	>= 2024.4.1114 < 2026.1.421	2026.1.421

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502