Is CVE-2026-13185 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13185 being exploited in the wild.

How severe is CVE-2026-13185?

High severity, with a CVSS score of 8.1, published 22 July 2026.

Which products and versions are affected?

Progress Software UI for ASP.NET AJAX >= 2013.1.220, <= 2026.2.519.

Is there a fix for CVE-2026-13185?

A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13185 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13185?

Check whether you run Progress Software UI for ASP.NET AJAX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13185: Progress Telerik UI for ASP.NET AJAX deserialization in RadPersistenceManager

Q: Is there a fix for CVE-2026-13185?

A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-13185 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-13185?

Check whether you run Progress Software UI for ASP.NET AJAX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13185 · Severity: high · CVSS 8.1 · Published 2026-07-22

A vulnerability exists in Telerik UI for ASP.NET AJAX, a popular suite of UI components used for building web applications. If an application is configured to store user interface settings (like layout or persistence) in browser cookies, an attacker can send a specially crafted cookie to take full control of the web server. This could lead to the theft of sensitive customer data, complete service disruption, or a total compromise of the hosting environment.

Technologies: Progress Software UI for ASP.NET AJAX. Vendors: Progress Software.

Quick answers

Is CVE-2026-13185 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13185 being exploited in the wild.
How severe is CVE-2026-13185?: High severity, with a CVSS score of 8.1, published 22 July 2026.
Which products and versions are affected?: Progress Software UI for ASP.NET AJAX >= 2013.1.220, <= 2026.2.519.
Is there a fix for CVE-2026-13185?: A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13185 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13185?: Check whether you run Progress Software UI for ASP.NET AJAX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in the RadPersistenceManager and RadDockLayout components of Telerik UI for ASP.NET AJAX. When these components are explicitly configured to use cookie-based storage (CookieStateStorageProvider or LayoutPersistenceRepositoryType set to Cookies), they fail to properly validate or sanitize the contents of the incoming cookie before deserialization. An unauthenticated remote attacker can exploit this by providing a malicious serialized object within a cookie, leading to arbitrary code execution on the server. The vulnerability is addressed in version 2026.2.708 (2026 Q2 SP1).

Affected products

Progress Software Telerik UI for ASP.NET AJAX >= 2013.1.220, <= 2026.2.519

Timeline

2026-07-22: disclosed
2026-07-22: advisory
2026-07-22: patched

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-cookie-deserialization-CVE-2026-13185

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.