This vulnerability (CVE-2026-13190) affects Progress Software Telerik UI for ASP.NET AJAX versions prior to 2026.2.708, specifically including version 2011.2.712. It involves unsafe deserialization of untrusted data in the persistence utilities, which enables an attacker to instantiate arbitrary types from manipulated persisted state data. This can lead to remote code execution on the affected system. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute arbitrary code on the affected system by leveraging unsafe deserialization of attacker-controlled data. This compromises confidentiality, integrity, and availability of the system running Telerik UI for ASP.NET AJAX versions prior to 2026.2.708, including version 2011.2.712.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Progress Software's advisories for updates. Until a patch is available, avoid using affected versions in exposed environments or implement additional controls to prevent untrusted data from reaching the deserialization routines.