This vulnerability affects Telerik UI for ASP.NET AJAX versions prior to 2026.2.708, where applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize cookie content that can be controlled by an attacker. This unsafe deserialization can lead to unauthenticated remote code execution, allowing an attacker to execute arbitrary code on the affected system. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not provided an official fix or remediation level as of the published date.

Successful exploitation allows unauthenticated remote code execution, which can compromise the confidentiality, integrity, and availability of the affected system. This can lead to full system compromise, data theft, or service disruption. The vulnerability arises from deserializing untrusted cookie data in specific Telerik UI components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using cookie-based storage in RadPersistenceManager or RadDockLayout components or implement strict input validation and deserialization controls if possible. Monitor vendor communications for updates on patches or official mitigations.