# PersistenceFramework Cookie Deserialization Vulnerability (CVE-2026-13185)

## Description

June 2026 - [CVE-2026-13185](https://www.cve.org/CVERecord?id=CVE-2026-13185)

* Progress® Telerik® UI for AJAX 2026.2.519 or earlier.

### What Are the Impacts

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications that explicitly configure cookie-based storage for `RadPersistenceManager` or `RadDockLayout` deserialize attacker-controlled cookie data, enabling remote code execution.

### Is My Application Vulnerable?

Your application is vulnerable if **any** of the following are true:

* `RadPersistenceManager` is configured to use `CookieStateStorageProvider`.
* `RadDockLayout.LayoutPersistenceRepositoryType` is set to `Cookies`.

Applications that use only server-side, database, or session-based persistence storage are not exposed by this issue.

## Issue

* CWE-502: Deserialization of Untrusted Data
* CAPEC-586: Object Injection

## Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

| Current Version                              | Update to                     |
| -------------------------------------------- | ----------------------------- |
| `>= 2013.1.220` && `<= 2026.2.519` (2026 Q2) | `>= 2026.2.708` (2026 Q2 SP1) |

Follow the [update instructions](https://www.telerik.com/products/aspnet-ajax/documentation/upgrade-compatibility/upgrading-instructions/upgrading-a-trial-to-a-developer-license-or-to-a-newer-version) for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Mitigation

If an immediate upgrade is not possible, apply the following measures to reduce risk.

* Do not use `CookieStateStorageProvider`.
* Ensure `RadDockLayout.LayoutPersistenceRepositoryType` is not set to `Cookies`.

## Notes

* If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.
* We would like to thank the researchers at Code White Security GmbH for their responsible disclosure and cooperation.

## External References

[CVE-2026-13185](https://www.cve.org/CVERecord?id=CVE-2026-13185) (High)

**CVSS:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, cookie-backed persistence state can trigger unsafe deserialization and remote code execution.

Discoverer Credit: Markus Wulftange with CODE WHITE GmbH