Telerik UI for AJAX RadFilter Vulnerable to RCE via Deserialization
The National Vulnerability Database (NVD) has detailed CVE-2026-6023, a high-severity insecure deserialization vulnerability (CVSS 8.1) affecting Progress Telerik UI for AJAX versions 2024.4.1114 through 2026.1.421. The flaw resides in the RadFilter control, specifically when it restores filter state exposed to the client.
Attackers can tamper with this client-side exposed state, leading to server-side remote code execution (RCE). This is a critical vulnerability that bypasses typical web application defenses and grants deep access. The underlying issue is CWE-502, a common and dangerous deserialization weakness.
For defenders, this means a direct path to server compromise if Telerik UI for AJAX is in use and the RadFilter control is exposed. Patching is paramount, but understanding the attack surface and potential for similar deserialization flaws in other components is equally critical. Attackers will always probe for these types of vulnerabilities because they offer such high impact.
What This Means For You
- If your organization uses Progress Telerik UI for AJAX, specifically versions 2024.4.1114 through 2026.1.421, you must immediately identify if the RadFilter control is in use and exposed to clients. Prioritize patching to mitigate the severe remote code execution risk. Audit your applications for other instances of client-exposed serialized data that could lead to similar deserialization attacks.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Telerik UI AJAX RadFilter Deserialization RCE Attempt - CVE-2026-6023
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6023 | Vulnerability | CVE-2026-6023 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 22, 2026 at 11:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
Google Antigravity Vulnerability Exploited for Malware Distribution
Security researchers have identified a critical remote code execution (RCE) vulnerability within Google's Antigravity system. While the specific details of the flaw remain under wraps...
Binutils Heap Overflow: Local Attackers Gain Code Execution via XCOFF Files
CVE-2026-6846 — A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file...
WordPress Plugin Flaw Lets Attackers Hijack Site Emails
CVE-2026-6235 — The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including,...