Progress SoftwareCVE-2026-13183

In Progress Telerik UI for AJAX prior to v2026.2.708

CVE-2026-13183 · Published Jul 22, 2026 · updated Aug 6, 2026

High7.5

Fix: upgrade to 2026.2.708 or later

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.

Affected versions

Package	Affected	Fixed in
Telerik UI for ASP.NET AJAX Product	>= 2010.1.309, < 2026.2.708	2026.2.708

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-208

More Progress Software advisories

All Progress Software

Medium 5.3Jul 22

Progress Software Telerik UI for ASP.NET AJAX: denial of serviceCVE-2026-14865fixed in 2026.2.708 Medium 6.5Jul 22

Progress Software Telerik UI for ASP.NET AJAX: hard-coded keyCVE-2026-14932fixed in 2026.2.708 High 8.1Jul 22

Progress Software Telerik UI for ASP.NET AJAX: remote code executionCVE-2026-13185fixed in 2026.2.708 High 8.1Jul 22

Progress Software Telerik UI for ASP.NET AJAX: path traversalCVE-2026-13186fixed in 2026.2.708 High 8.1Jul 22

In Progress Telerik UI for AJAX prior to v2026.2.708CVE-2026-13187fixed in 2026.2.708 Medium 5.9Jul 22

Progress Software Telerik UI for ASP.NET AJAX: insufficient authenticity checkCVE-2026-13188fixed in 2026.2.708