CVE-2026-13190: Telerik UI for AJAX RCE Vulnerability

CVE-2026-13190 Overview

CVE-2026-13190 is an insecure deserialization vulnerability in Progress® Telerik® UI for AJAX prior to version 2026.2.708. The flaw resides in the persistence utilities, which perform unsafe type instantiation from attacker-influenced persisted state. An unauthenticated attacker who can supply crafted persisted state to the framework can trigger arbitrary type resolution during deserialization. Successful exploitation leads to remote code execution on the underlying ASP.NET web server. The weakness is classified under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Unauthenticated remote code execution against ASP.NET applications embedding vulnerable Telerik UI for AJAX controls, with full confidentiality, integrity, and availability impact.

Affected Products

Progress Telerik UI for AJAX versions prior to 2026.2.708
ASP.NET Web Forms applications embedding vulnerable Telerik AJAX controls
Applications relying on the Telerik persistence framework for state serialization

Discovery Timeline

2026-07-22 - CVE-2026-13190 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13190

Vulnerability Analysis

The vulnerability exists in the Telerik UI for AJAX persistence framework. The framework serializes and later reconstructs control state, but the type resolver accepts type identifiers influenced by attacker-controlled input. During reconstruction, the deserializer instantiates arbitrary .NET types and invokes their constructors, property setters, or callback methods. Attackers can chain gadget types available in the application's loaded assemblies to reach code execution primitives such as process creation or arbitrary file writes. Because the persistence layer is reachable across the network without authentication, exploitation does not require prior credentials on the target application.

Root Cause

The root cause is unsafe type resolution during deserialization. The persistence utilities trust the type descriptor embedded within the persisted payload instead of restricting reconstruction to an allow-list of expected safe types. This pattern falls under [CWE-502] and is a recurring class of defect in .NET binary and object serializers when TypeNameHandling or equivalent polymorphic resolution is left unconstrained.

Attack Vector

Exploitation is network-based. An attacker submits a crafted persisted-state payload to an endpoint that hands the data to the Telerik persistence framework. The framework decodes the payload, resolves the attacker-supplied type, and instantiates it inside the ASP.NET worker process. The high attack complexity reflects the need to construct a working gadget chain and, in some deployments, to obtain or predict keying material protecting the persisted state. The vulnerability manifests during type instantiation in the persistence layer; refer to the Telerik Security Advisory CVE-2026-13190 for vendor technical details.

Detection Methods for CVE-2026-13190

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe or the ASP.NET worker, particularly cmd.exe, powershell.exe, or rundll32.exe.
New or modified files under the web application root, including .aspx, .ashx, or .dll artifacts written by the IIS identity.
Outbound network connections initiated by the IIS worker process to previously unseen hosts.
HTTP POST requests containing large base64-encoded payloads targeting Telerik handlers such as Telerik.Web.UI.WebResource.axd or persistence-related endpoints.

Detection Strategies

Inventory all ASP.NET applications for Telerik.Web.UI assemblies and flag versions below 2026.2.708.
Alert on deserialization exceptions in Windows Event logs and application logs that reference Telerik persistence classes.
Hunt for behavioral sequences where IIS worker processes spawn interpreters or write executable content into web directories.

Monitoring Recommendations

Enable IIS request logging with full query string and body capture on endpoints handling Telerik controls.
Forward Sysmon process creation and file creation events from web servers to a central analytics platform.
Baseline outbound connections from IIS worker processes and alert on deviations.

How to Mitigate CVE-2026-13190

Immediate Actions Required

Upgrade Progress Telerik UI for AJAX to version 2026.2.708 or later on every affected ASP.NET application.
Rotate any machine keys, encryption keys, and Telerik-specific keying material after patching to invalidate captured payloads.
Restrict network exposure of ASP.NET applications embedding Telerik controls until the update is deployed.
Review web server file systems and process ancestry for signs of prior exploitation before returning systems to production.

Patch Information

Progress addresses CVE-2026-13190 in Telerik UI for AJAX version 2026.2.708. The fix constrains type resolution within the persistence framework so that only expected types can be instantiated from persisted state. Deployment guidance is available in the Telerik Security Advisory CVE-2026-13190.

Workarounds

Place vulnerable applications behind a web application firewall with rules that block serialized .NET type markers such as $type, System.Windows.Data.ObjectDataProvider, and System.Diagnostics.Process in request bodies.
Enforce authentication and IP allow-listing on management and administrative endpoints that expose Telerik handlers.
Run the IIS application pool identity with least privilege and deny write access to web content directories where feasible.

bash

# Configuration example: identify vulnerable Telerik.Web.UI assemblies on a Windows host
Get-ChildItem -Path 'C:\inetpub' -Recurse -Filter 'Telerik.Web.UI.dll' |
  ForEach-Object {
    [PSCustomObject]@{
      Path    = $_.FullName
      Version = (Get-Item $_.FullName).VersionInfo.FileVersion
    }
  } |
  Where-Object { [version]$_.Version -lt [version]'2026.2.708' }