Progress SoftwareCVE-2026-13182

Progress Software Telerik UI for ASP.NET AJAX: information disclosure in errors

CVE-2026-13182 · Published Jul 22, 2026 · updated Aug 6, 2026

High7.5

Fix: upgrade to 2026.2.708 or later

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.

Affected versions

Package	Affected	Fixed in
Telerik UI for ASP.NET AJAX Product	>= 2010.1.309, < 2026.2.708	2026.2.708

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-209

More Progress Software advisories

All Progress Software

Medium 5.3Jul 22

Progress Software Telerik UI for ASP.NET AJAX: denial of serviceCVE-2026-14865fixed in 2026.2.708 Medium 6.5Jul 22

Progress Software Telerik UI for ASP.NET AJAX: hard-coded keyCVE-2026-14932fixed in 2026.2.708 High 8.1Jul 22

Progress Software Telerik UI for ASP.NET AJAX: remote code executionCVE-2026-13185fixed in 2026.2.708 High 8.1Jul 22

Progress Software Telerik UI for ASP.NET AJAX: path traversalCVE-2026-13186fixed in 2026.2.708 High 8.1Jul 22

In Progress Telerik UI for AJAX prior to v2026.2.708CVE-2026-13187fixed in 2026.2.708 Medium 5.9Jul 22

Progress Software Telerik UI for ASP.NET AJAX: insufficient authenticity checkCVE-2026-13188fixed in 2026.2.708