PersistenceFramework Cookie Deserialization Vulnerability (CVE-2026-13185)

Updated on Jul 22, 2026

Description

June 2026 - CVE-2026-13185

• Progress® Telerik® UI for AJAX 2026.2.519 or earlier.

What Are the Impacts

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications that explicitly configure cookie-based storage for RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie data, enabling remote code execution.

Is My Application Vulnerable?

Your application is vulnerable if any of the following are true:

• RadPersistenceManager is configured to use CookieStateStorageProvider.
• RadDockLayout.LayoutPersistenceRepositoryType is set to Cookies.

Applications that use only server-side, database, or session-based persistence storage are not exposed by this issue.

Issue

• CWE-502: Deserialization of Untrusted Data
• CAPEC-586: Object Injection

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2013.1.220 && <= 2026.2.519 (2026 Q2)	>= 2026.2.708 (2026 Q2 SP1)

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following measures to reduce risk.

• Do not use CookieStateStorageProvider.
• Ensure RadDockLayout.LayoutPersistenceRepositoryType is not set to Cookies.

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank the researchers at Code White Security GmbH for their responsible disclosure and cooperation.

External References

CVE-2026-13185 (High)

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, cookie-backed persistence state can trigger unsafe deserialization and remote code execution.

Discoverer Credit: Markus Wulftange with CODE WHITE GmbH