What is the CVSS score of CVE-2026-13183?

CVE-2026-13183 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Telerik Ui For Asp Net Ajax are affected by CVE-2026-13183?

Progress Telerik UI for ASP.NET AJAX versions before 2026.2.708 contain a high-severity information disclosure vulnerability (CVE-2026-13183) enabling remote attackers to extract sensitive encrypted…. A patch is available.

How to fix or mitigate CVE-2026-13183?

Within 24 hours, conduct an inventory of all production systems running Progress Telerik UI for ASP.NET AJAX and confirm versions; implement network segmentation or WAF-level rate limiting on RadAsyncUpload endpoints if immediate patching is not feasible. Within 7 days, deploy WAF rules designed to detect and block timing-based probing against upload metadata endpoints, review and strengthen encryption protocols for sensitive metadata, and contact Progress support for patch availability confirmation and interim guidance. Within 30 days, upgrade all identified systems to Telerik UI v2026.2.708 or later when the patch becomes available, or implement alternative ASP.NET upload components with constant-time cryptographic validation.

Telerik Ui For Asp Net Ajax CVE-2026-13183

EUVD-2026-47688 HIGH

Observable Timing Discrepancy (CWE-208)

2026-07-22 ProgressSoftware

GHSA-c5xq-jjwj-x369

Information Disclosure Telerik Ui For Asp Net Ajax Progress Software

7.5

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (ProgressSoftware) · only source for this CVE.

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:31 vuln.today

CVE Published

Jul 22, 2026 - 13:36 cve.org

HIGH 7.5

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.

AnalysisAI

Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attackers to exploit a timing oracle in RadAsyncUpload's upload metadata processing, recovering protected (encrypted/signed) metadata values through measurable response-time differences during cryptographic validation. The flaw stems from non-constant-time comparison of the metadata's cryptographic integrity, letting an attacker probe validity incrementally. No public exploit was identified at time of analysis, and it is not listed in CISA KEV; EPSS and POC data were not provided.