SB2026072932 - Multiple vulnerabilities in Progress Telerik UI for AJAX
Published: July 29, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Unsafe reflection (CVE-ID: CVE-2026-13181)
CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to behavior injection issue within AsyncUploadTypeName. A remote attacker can execute arbitrary code on the target system.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-13190)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data in the persistence utilities. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Path traversal (CVE-ID: CVE-2026-13186)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in the file-based persistence storage provider. A remote attacker can send a specially crafted HTTP request and upload arbitrary files on the system, leading to arbitrary code execution.
4) Deserialization of Untrusted Data (CVE-ID: CVE-2026-13185)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data in RadPersistenceManager and RadDockLayout. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Use of hard-coded cryptographic key (CVE-ID: CVE-2026-13184)
CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to use of hard-coded cryptographic key when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured. A remote attacker can forge protected upload metadata.
6) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-13183)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application within RadAsyncUpload upload metadata processing. A remote attacker can gain unauthorized access to sensitive information on the system.
7) Information Exposure Through an Error Message (CVE-ID: CVE-2026-13182)
CWE-ID: CWE-209 - Information Exposure Through an Error Message
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the RadAsyncUpload client-state processing distinguishes decrypt failures from invalid-JSON parse failures. A remote attacker can gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.
References
- https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-asyncuploadtypename-deserialization-CVE-2026-13181
- https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-framework-unsafe-type-resolution-CVE-2026-13190
- https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-appdata-path-traversal-deserialization-CVE-2026-13186
- https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-persistence-cookie-deserialization-CVE-2026-13185
- https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-unauth-deserialization-chain-cve-2026-13184
- https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-timing-oracle-CVE-2026-13183
- https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-padding-oracle-cve-2026-13182