Is CVE-2026-13190 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13190 being exploited in the wild.

How severe is CVE-2026-13190?

High severity, with a CVSS score of 8.1, published 22 July 2026.

Which products and versions are affected?

Progress Software Telerik UI for ASP.NET AJAX >= 2011.2.712, < 2026.2.708.

Is there a fix for CVE-2026-13190?

A patch was published on 2026-07-22: Fix released in version 2026.2.708 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13190 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13190?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13190: Progress Telerik UI for ASP.NET AJAX deserialization in PersistenceFramework

Q: Is there a fix for CVE-2026-13190?

A patch was published on 2026-07-22: Fix released in version 2026.2.708 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-13190 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-13190?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13190 · Severity: high · CVSS 8.1 · Published 2026-07-22

Progress Telerik UI for ASP.NET AJAX, a popular suite of UI components for web applications, contains a security flaw in its persistence framework. If an attacker can modify the data stored by the application's state management system, they could potentially execute malicious code on the server. This could lead to a complete takeover of the affected web server and unauthorized access to sensitive data.

Quick answers

Is CVE-2026-13190 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13190 being exploited in the wild.
How severe is CVE-2026-13190?: High severity, with a CVSS score of 8.1, published 22 July 2026.
Which products and versions are affected?: Progress Software Telerik UI for ASP.NET AJAX >= 2011.2.712, < 2026.2.708.
Is there a fix for CVE-2026-13190?: A patch was published on 2026-07-22: Fix released in version 2026.2.708 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13190 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13190?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization vulnerability (CWE-502) exists in the RadPersistenceManager component of Telerik UI for ASP.NET AJAX. The flaw is rooted in the PersistenceFramework's handling of persisted state, where unsafe type instantiation can occur if an attacker can influence the storage source (e.g., via file-based or cookie-based storage). Exploitation requires the application to be configured such that the StorageProviderKey is derived from user-controlled input or the storage medium itself is writable by the attacker. Successful exploitation allows for Object Injection (CAPEC-586) and Remote Code Execution (RCE). The issue is resolved in version 2026.2.708 (2026 Q2 SP1).

Affected products

Progress Software Telerik UI for ASP.NET AJAX >= 2011.2.712, < 2026.2.708

Timeline

2026-07-22: advisory: Vendor advisory and NVD entry published
2026-07-22: patched: Fix released in version 2026.2.708

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-framework-unsafe-type-resolution-CVE-2026-13190

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.