Progress SoftwareCVE-2026-19219
Progress Software Telerik UI for ASP.NET AJAX: remote code execution
High8.1CVE-2026-19219 · Published Sep 2, 2026 · updated Sep 8, 2026
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Telerik UI for ASP.NET AJAX Product | >= 2011.2.712, < 2026.3.812 | 2026.3.812 |
Details and references
More Progress Software advisories
All Progress Software| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 11 | Progress Software Chef Automate: missing authentication | Critical10.0 | 4.13.520 |
| Sep 2 | Progress Software Telerik UI for ASP.NET AJAX: path traversal | High7.5 | 2026.3.812 |
| Aug 17 | Progress Software ShareFile Storage Zones Controller: path traversal | High7.2 | No fix yet |
| Aug 17 | Progress Software ShareFile Storage Zones Controller: unsafe deserialization | High8.0 | No fix yet |
| Aug 17 | Progress Software ShareFile Storage Zones Controller: remote code execution | High7.2 | No fix yet |
| Aug 12 | Progress Software WhatsUp Gold: remote code execution | High8.8 | 26.0.2 |