CVE-2026-6023: Telerik UI for AJAX RCE Vulnerability

CVE-2026-6023 Overview

CVE-2026-6023 is an insecure deserialization vulnerability affecting Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421. The vulnerability exists in the RadFilter control when restoring filter state that has been exposed to the client. An attacker who can tamper with this state can achieve server-side remote code execution, making this a critical security concern for web applications using affected Telerik UI components.

Critical Impact

Server-side remote code execution is possible through insecure deserialization in the RadFilter control, allowing attackers to execute arbitrary code on vulnerable servers.

Affected Products

• Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421
• ASP.NET web applications using the RadFilter control with client-exposed state
• Applications that expose filter state to the client without proper validation

Discovery Timeline

• April 22, 2026 - CVE-2026-6023 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6023

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data), a well-known class of security weaknesses that can lead to severe consequences including remote code execution. The RadFilter control in Telerik UI for AJAX provides filtering capabilities for data-bound controls, and it maintains filter state that can be serialized and restored. When this state is exposed to the client-side, it becomes susceptible to tampering.

The insecure deserialization occurs because the application deserializes the filter state without adequately validating or sanitizing the input data. An attacker can craft a malicious serialized payload that, when deserialized by the server, executes arbitrary code in the context of the web application.

The attack can be conducted over the network without requiring prior authentication. However, successful exploitation requires specific conditions to be met, including the filter state being exposed to the client and the attacker having the ability to intercept and modify the serialized data before it reaches the server.

Root Cause

The root cause of this vulnerability is the insecure handling of serialized filter state data in the RadFilter control. When applications expose the filter state to the client (typically through ViewState, hidden fields, or AJAX requests), the serialized data becomes accessible to potential attackers. The deserialization process on the server does not perform adequate validation of the incoming data, allowing maliciously crafted payloads to be processed.

.NET deserialization vulnerabilities are particularly dangerous because the .NET serialization framework can instantiate arbitrary types and invoke methods during the deserialization process. Attackers can leverage known gadget chains (such as those in ysoserial.net) to construct payloads that execute arbitrary code when deserialized.

Attack Vector

The attack vector is network-based, requiring the attacker to intercept or manipulate the filter state data transmitted between the client and server. The typical attack flow involves:

1. Identifying an application using Telerik UI for AJAX with the RadFilter control
2. Intercepting the serialized filter state data (through proxy interception or network monitoring)
3. Crafting a malicious serialized payload using known .NET deserialization gadget chains
4. Submitting the tampered state back to the server
5. The server deserializes the malicious payload, triggering code execution

The vulnerability requires no authentication and no user interaction for exploitation, though the attack complexity is considered high due to the specific conditions required for successful exploitation. For detailed technical information on the vulnerability and remediation steps, refer to the Telerik Security Advisory.

Detection Methods for CVE-2026-6023

Indicators of Compromise

• Unusual or malformed serialized data in RadFilter-related HTTP requests
• Unexpected process spawning from the IIS worker process (w3wp.exe)
• Suspicious command execution patterns originating from the web application context
• Network traffic containing known .NET deserialization gadget chain signatures

Detection Strategies

• Monitor web application logs for anomalous RadFilter state submissions with unusually large or malformed payloads
• Implement Web Application Firewall (WAF) rules to detect common .NET deserialization attack patterns
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process creation from web server processes
• Use application-level logging to track deserialization operations and flag unexpected type instantiations

Monitoring Recommendations

• Enable detailed logging for ASP.NET applications to capture serialization/deserialization events
• Configure alerts for process execution chains originating from w3wp.exe that spawn command shells or scripting interpreters
• Monitor for outbound network connections from web server processes that may indicate successful exploitation
• Implement file integrity monitoring on web application directories to detect unauthorized modifications

How to Mitigate CVE-2026-6023

Immediate Actions Required

• Upgrade Telerik UI for AJAX to a version newer than 2026.1.421 that contains the security fix
• Audit applications to identify instances where RadFilter state is exposed to the client
• Implement network segmentation to limit the impact of potential compromise
• Review web server logs for any indicators of exploitation attempts

Patch Information

Progress has released security updates to address this vulnerability. Organizations should upgrade their Telerik UI for AJAX installations to versions beyond 2026.1.421. Detailed patch information and upgrade guidance are available in the Telerik Security Advisory for CVE-2026-6023.

Workarounds

• Avoid exposing RadFilter state to the client-side where possible; use server-side state management instead
• Implement additional server-side validation of all incoming serialized data before deserialization
• Apply strict input validation and consider using allowlists for expected data types in deserialization operations
• Deploy WAF rules to block requests containing known malicious deserialization payloads

# Configuration example - Restrict RadFilter state exposure in web.config
# Add ViewState encryption and MAC validation
<system.web>
  <machineKey validation="HMACSHA256" 
              validationKey="AutoGenerate,IsolateApps" 
              decryption="AES" 
              decryptionKey="AutoGenerate,IsolateApps" />
  <pages viewStateEncryptionMode="Always" 
         enableViewStateMac="true" />
</system.web>