New to Telerik UI for ASP.NET AJAX? Start a free 30-day trial

PersistenceFramework Unsafe Type Resolution Vulnerability (CVE-2026-13190)

Updated on Jul 22, 2026

Description

June 2026 - CVE-2026-13190

Progress® Telerik® UI for AJAX 2026.2.519 or earlier.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the PersistenceFramework allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

Is My Application Vulnerable?

Your application may be vulnerable if all of the following are true:

RadPersistenceManager is used in the application.
Persisted state can be influenced by an attacker through a writable storage source (file-based, cookie-based, or similar).
The application has not been upgraded to a patched version — see the Solution section below.

Issue

CWE-502: Deserialization of Untrusted Data
CAPEC-586: Object Injection

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
`>= 2011.2.712` && `<= 2026.2.519` (2026 Q2)	`>= 2026.2.708` (2026 Q2 SP1)

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following measures to reduce risk.

Ensure persistence state storage sources are not writable by unauthenticated or untrusted users. For file-based storage, this means the directory used by the storage provider should not be reachable or writable through any other application feature (such as a file upload endpoint).

Do not derive the persistence storage key from user-controlled input. The default storage key is a fixed value and is safe. This issue only affects applications that explicitly set the key to a value taken from request data:

csharp

// Safe — hardcoded application key
PersistenceManager1.StorageProviderKey = "my-app-persistence-state";

// UNSAFE — never derive from request data
// PersistenceManager1.StorageProviderKey = Request.QueryString["userId"];
// PersistenceManager1.StorageProviderKey = Request.Form["stateKey"];
// PersistenceManager1.StorageProviderKey = Request.Cookies["stateId"].Value;

Notes

If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
This issue was identified during internal security review and hardening.

External References

CVE-2026-13190 (High)

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the PersistenceFramework can enable remote code execution when attacker-controlled data reaches the persistence state processing path.