Telerik AJAX Deserialization Enables Remote Code Execution

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Progress Telerik UI for AJAX versions prior to 2026.2.708 contain a critical deserialization flaw in persistence utilities that allows attackers to instantiate arbitrary types from untrusted serialized data. This vulnerability is particularly dangerous because deserialization of untrusted data is a well-known attack vector that can lead to immediate remote code execution without requiring authentication. Organizations using affected Telerik AJAX components—common in enterprise .NET applications—face significant risk, as attackers can exploit this to gain complete system compromise through seemingly benign persisted application state.

Casky's security skills mapped to MITRE ATT&CK enable detection of the three-stage attack pattern behind this CVE. During Initial Access (TA0001), practitioners see skills identifying suspicious serialized payloads in HTTP requests or stored persistence mechanisms. Execution (TA0002) detection focuses on unsafe deserialization calls that instantiate unexpected object types, signaling gadget chain exploitation. Defense Evasion (TA0043) skills catch techniques where attackers obfuscate serialized data or exploit trust boundaries in application state handling. With Claude AI's extended reasoning across 446 matching skills, practitioners receive correlated findings showing how persisted state transitions from user input through deserialization to code execution, enabling them to distinguish legitimate application behavior from exploitation attempts and prioritize patching this high-severity issue.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13190.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-13190

Casky has 446 skills that investigate the attack patterns behind CVE-2026-13190. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn