CVE-2026-13185 Overview
CVE-2026-13185 is an insecure deserialization vulnerability in Progress® Telerik® UI for AJAX versions prior to v2026.2.708. Applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content without validation. This flaw enables unauthenticated remote code execution against affected web applications. The weakness is classified under [CWE-502] Deserialization of Untrusted Data.
Critical Impact
Unauthenticated attackers can achieve remote code execution on servers running vulnerable Telerik UI for AJAX applications by supplying crafted cookie payloads.
Affected Products
- Progress Telerik UI for AJAX versions prior to v2026.2.708
- Applications using RadPersistenceManager with cookie-based storage
- Applications using RadDockLayout with cookie-based storage
Discovery Timeline
- 2026-07-22 - CVE-2026-13185 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-13185
Vulnerability Analysis
The vulnerability resides in Telerik UI for AJAX components that persist state through client-side cookies. Both RadPersistenceManager and RadDockLayout support cookie-based storage modes for saving control state across requests. When these components read the persisted state, they deserialize the raw cookie content back into .NET objects. The deserialization occurs before any signature verification or type filtering, meaning the server trusts data fully controlled by the client. An attacker who crafts a malicious serialized payload can trigger arbitrary type instantiation and gadget-chain execution within the ASP.NET worker process.
Root Cause
The root cause is unsafe deserialization of untrusted input [CWE-502]. The affected components accept serialized object graphs from HTTP cookies and reconstruct them without validating the payload origin, integrity, or type allowlist. Because cookies are user-controllable HTTP headers, any client can submit substituted data. The absence of a message authentication code or restricted type binder allows deserialization gadgets present in the .NET runtime or referenced assemblies to execute during object reconstruction.
Attack Vector
Exploitation is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to an endpoint of a vulnerable Telerik application, including a forged cookie whose name matches a RadPersistenceManager or RadDockLayout persistence key. The server deserializes the cookie value, invoking gadget chains that execute attacker-chosen commands under the identity of the application pool. The high attack complexity rating reflects the requirement to identify the correct cookie name and craft a working gadget chain. Refer to the Telerik Security Advisory CVE-2026-13185 for vendor-specific technical details.
Detection Methods for CVE-2026-13185
Indicators of Compromise
- Unexpected child processes spawned by w3wp.exe such as cmd.exe, powershell.exe, or rundll32.exe
- Inbound HTTP requests containing unusually large or Base64-encoded cookie values targeting Telerik endpoints
- New files written to web application directories or temporary paths following Telerik cookie traffic
- Outbound network connections initiated by the ASP.NET worker process to unknown external hosts
Detection Strategies
- Inspect web server logs for cookies matching RadPersistenceManager or RadDockLayout key patterns with atypical entropy or length
- Alert on IIS worker process (w3wp.exe) creating shell or scripting interpreter child processes
- Monitor for known .NET deserialization gadget signatures such as TypeConfuseDelegate or ObjectDataProvider in HTTP request bodies and headers
Monitoring Recommendations
- Enable full HTTP request logging including cookie headers for applications that expose Telerik AJAX endpoints
- Correlate process creation telemetry from IIS hosts with inbound web traffic to detect exploitation chains
- Track file integrity of web root directories to identify unauthorized webshell deployment
How to Mitigate CVE-2026-13185
Immediate Actions Required
- Upgrade Progress Telerik UI for AJAX to v2026.2.708 or later across all production and staging systems
- Inventory applications using RadPersistenceManager and RadDockLayout and identify those configured with cookie-based storage
- Rotate machine keys and invalidate existing session cookies after patching to remove any pre-positioned payloads
Patch Information
Progress has released v2026.2.708 of Telerik UI for AJAX, which remediates the deserialization flaw. Consult the Telerik Security Advisory CVE-2026-13185 for the official upgrade guidance and release notes.
Workarounds
- Reconfigure RadPersistenceManager and RadDockLayout to use server-side storage providers instead of cookie-based storage
- Deploy a web application firewall rule to block or strip cookies matching Telerik persistence key patterns until patching is complete
- Restrict application pool identities to least-privilege service accounts to reduce the impact of successful exploitation
# Configuration example - refer to vendor advisory for authoritative guidance
# See: https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-cookie-deserialization-CVE-2026-13185
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
