This vulnerability (CWE-502) affects Telerik UI for ASP.NET AJAX versions before 2026.2.708. The issue arises because the RadPersistenceManager or RadDockLayout components deserialize data from cookies without proper validation. An attacker can craft malicious cookie content that, when deserialized, leads to remote code execution without requiring authentication. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on the affected system, potentially leading to full system compromise. Confidentiality, integrity, and availability of the affected application and underlying system are severely impacted.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid using cookie-based storage in RadPersistenceManager or RadDockLayout or implement strict validation and sanitization of cookie data to prevent deserialization of untrusted content.