What is the CVSS score of CVE-2026-13184?

CVE-2026-13184 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Telerik UI AJAX are affected by CVE-2026-13184?

Progress Telerik UI for ASP.NET AJAX prior to version 2026.2.708 contains a cryptographic key predictability vulnerability that enables unauthenticated remote attackers to forge upload metadata, with…. A patch is available.

How to fix or mitigate CVE-2026-13184?

Within 24 hours, identify all instances of Progress Telerik UI for ASP.NET AJAX in your environment and verify their versions; immediately disable upload functionality or restrict access to trusted networks if the installation predates v2026.2.708. Within 7 days, configure Telerik.Upload.ConfigurationHashKey with a strong, unpredictable value and explicitly set ASP.NET machineKey in web.config to eliminate reliance on predictable defaults; audit configurations across all affected systems. Within 30 days, monitor the Progress vendor advisory for release of patch version 2026.2.708 or later and establish a patching timeline; immediately upgrade all affected installations upon availability to fully remediate this vulnerability.

Telerik UI AJAX CVE-2026-13184

EUVD-2026-47689 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-07-22 ProgressSoftware

GHSA-xj5r-8wvg-3cxf

Information Disclosure Telerik Ui For Asp Net Ajax Progress Software

7.5

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.9 MEDIUM

Network unauthenticated forgery justifies AV:N/PR:N and I:H, but reliance on a non-default missing-machineKey configuration and no direct C/A impact warrants AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:32 vuln.today

CVE Published

Jul 22, 2026 - 13:37 cve.org

HIGH 7.5

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.

AnalysisAI

Cryptographic key predictability in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 lets remote unauthenticated attackers forge integrity-protected upload metadata when Telerik.Upload.ConfigurationHashKey is absent and no explicit machineKey is configured, causing the upload handler to fall back to a predictable default key. This forgery capability is not the end goal but a stepping stone: it unlocks further exploit chains (notably the RAU unauthenticated deserialization chain referenced in the vendor KB). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

The affected technology is Telerik UI for ASP.NET AJAX (CPE cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax), a widely used commercial web UI control suite for classic ASP.NET WebForms/AJAX applications. The root cause is CWE-321 (Use of a Hard-coded/predictable Cryptographic Key): the RadAsyncUpload/RAU component protects upload metadata (file path, temp folder, target destination) with a keyed integrity mechanism (HMAC-style hashing). That key is normally derived from Telerik.Upload.ConfigurationHashKey or the ASP.NET machineKey. When both are missing, the component falls back to a built-in default value that is the same across installations, so the integrity check becomes forgeable. This mirrors the historical class of Telerik RadAsyncUpload weaknesses (CVE-2017-11317 and the RAU deserialization lineage) where predictable/leaked keys enabled metadata forgery and subsequent insecure deserialization.

RemediationAI

Vendor-released patch: upgrade Telerik UI for ASP.NET AJAX to v2026.2.708 or later, which corrects the predictable-key fallback; this is the primary and recommended fix per the Progress advisory (https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-unauth-deserialization-chain-cve-2026-13184). If immediate upgrade is not possible, the direct compensating control is to explicitly configure a strong, unique Telerik.Upload.ConfigurationHashKey and a static application-specific machineKey in web.config so the component no longer falls back to the predictable default - this restores integrity protection with essentially no functional side effects and is the vendor-standard hardening for RadAsyncUpload. As an additional layer, if the async upload (RadAsyncUpload/RAU handler) feature is unused, disable or remove the Telerik.Web.UI.WebResource.axd/AsyncUpload handler, and restrict network access to the upload endpoint via WAF rules or IP allow-listing; note that disabling the handler will break any application feature relying on asynchronous file uploads.