home / blog
2026-11-06 · high
CVE-2026-6023: RCE in Telerik UI for AJAX (RadFilter)
RCE in RadFilter (Telerik UI) via insecure deserialization. Versions 2024.4-2026.1 affected. CVSS 8.1.
CVE-2026-6023 concerns an insecure deserialization flaw in the RadFilter control of Progress® Telerik® UI for AJAX. The control restores filter state from data exposed to the client; an attacker who modifies this data can force the server to deserialize malicious payloads, causing remote code execution (RCE). Versions 2024.4.1114 through 2026.1.421 are affected.
The severity is HIGH (CVSS 8.1). The attack vector is tampering with filter state from the client, with direct impact on server integrity. The vulnerability was officially published by NVD on April 22, 2026. A signal from a GitHub repository was detected on November 6, 2026, indicating potential attacker interest; however, public exploitation status is not confirmed by available data.
Defense actions: (1) Immediately inventory Telerik UI for AJAX instances in production, especially where the RadFilter control is used. (2) Contact Progress for security patches after version 2026.1.421 and prioritize deployment. (3) Examine server logs for anomalous deserialization patterns or RadFilter-related exceptions. (4) Implement strict input/output validation on filter data and enforce strict state data validation.
At a glance
- What
- The RadFilter control in Telerik UI for AJAX is vulnerable to insecure deserialization (CVE-2026-6023) when restoring filter state. If the state is exposed to the client, an attacker can modify it to cause remote code execution on the server.
- Severity
- CVSS 8.1 (HIGH). Confirmed RCE. Impact: arbitrary code execution on the server with web application privileges.
- Affected versions
- Telerik UI for AJAX versions from 2024.4.1114 through 2026.1.421.
- Fix
- Update to versions after 2026.1.421. Consult Progress for available security patch releases.
- Status
- Published on NVD on 2026-04-22. GitHub signal detected on 2026-11-06 indicates attacker interest. Public exploit not confirmed by available data.
- Action
- Inventory: identify Telerik UI for AJAX instances in production. Priority: apply Progress patch immediately. Verification: check server logs for deserialization anomalies.
Sources: NVD, CVE-2026-6023