CVE-2026-13182
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.
CVSS score7.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness type (CWE)CWE-209
Vendorsprogress
Affected products
| Vendors | Product | Versions |
|---|---|---|
| progress | telerik ui for asp.net ajax | < 2026.2.708 |
Related articles
FortiMail and NetScaler Exploitation Drives an Urgent Enterprise Patch Cycle
FortiMail path traversal and NetScaler SAML flaw under active exploit join CISA KEV, forcing urgent patching plus PHP, PaperCut and Spectre fixes.
Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE
Public Telerik RadAsyncUpload exploit chains AES padding oracle to unauthenticated RCE. Learn affected versions, conditions, CVEs and fix in 2026.2.708.
This product uses the NVD API but is not endorsed or certified by the NVD.