Telerik AJAX Insecure Deserialization Remote Code Execution

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-13185 is a critical insecure deserialization vulnerability affecting Progress Telerik UI for AJAX versions prior to v2026.2.708. The flaw exists in RadPersistenceManager and RadDockLayout components, which blindly deserialize cookie data without proper validation. An unauthenticated attacker can craft malicious serialized objects in cookies to achieve remote code execution on the target server. This vulnerability is particularly dangerous because it requires no authentication, affects widely-used UI framework components, and impacts any organization deploying vulnerable Telerik AJAX applications in web environments. The attack surface is broad, affecting development teams using this popular library for ASP.NET applications.

Casky's 446 matching security skills leverage Claude's extended reasoning to detect exploitation attempts across MITRE ATT&CK initial access (TA0001), persistence (TA0043), and execution (TA0002) techniques. Practitioners using Casky would identify suspicious patterns including: malformed or unusually large cookie payloads targeting RadPersistenceManager endpoints, deserialization exceptions in application logs followed by unexpected process spawning, and network signatures of gadget chain exploitation common in .NET deserialization attacks. The platform's skills would correlate cookie tampering attempts with downstream execution indicators—such as new process creation or command execution—to surface the complete attack chain. Advanced detection would flag attempts to establish persistence through serialized object injection, revealing attackers moving beyond initial compromise toward maintaining access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13185.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-13185

Casky has 446 skills that investigate the attack patterns behind CVE-2026-13185. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn