CVE-2026-13185Disclosure(progress / telerik_ui_for_asp.net_ajax)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch progress telerik_ui_for_asp.net_ajax systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.

progress CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-cookie-deserialization-CVE-2026-13185

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

telerik_ui_for_asp.net_ajax

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-23); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

progress

Products

telerik_ui_for_asp.net_ajax

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-23	1	Disclosure1
2026-09-07	1	General1

Full discourse2 posts

NewNormal Security@NewScanTeam45d
General
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 7 Sep 2026 𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan: 🔓 IP allow-list bypass via a spoofed X-Forwarded-For — reaches the admin pages the IP check was the only thing guarding (PrestaShop CVE-2026-84186) 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Deserialization RCE in an http://ASP.NET file-upload control — unauthenticated code execution on the web server (Progress Telerik CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184, CVE-2026-13185, CVE-2026-13186, CVE-2026-13190) 📦 Stored XSS in a WordPress plugin's lazy-load image parser — script that runs for every later visitor to the page (Powerkit CVE-2026-2390) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #Deserialization #CSO #REDTEAM
Post summary
The post lists several newly discovered CVEs with brief technical descriptors but offers no PoC, exploit code, active exploitation evidence, or patch information.
0000060
7 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters91d
Disclosure
#CVE-2026-13185 - Critical RCE in Progress Telerik UI for #AJAX. Cookie deserialization flaw. #CVSS 8.1. No patch yet. Mitigate immediately. #CVE #Progress #infosec #devops #devsecops #developer #sysadmin #git #github #gitlab #apache #nginx #redteam #blueteam #china #japan https://www.valtersit.com/cve/CVE-2026-13185
Post summary
CVE-2026-13185 is a critical remote code execution flaw in Progress Telerik UI for AJAX, arising from cookie deserialization. No patch is available yet; immediate mitigation is advised.
00000463
989 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	progress	telerik_ui_for_asp.net_ajax	-	-	-

Explore more

Back to dashboard progress CVEs telerik_ui_for_asp.net_ajax vulnerabilities