What is the CVSS score of CVE-2026-13187?

CVE-2026-13187 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Telerik UI are affected by CVE-2026-13187?

Progress Telerik UI for ASP.NET AJAX contains a critical vulnerability (CVE-2026-13187, CVSS 8.1) that allows remote attackers to manipulate dialog processing and facilitate subsequent unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-13187?

Within 24 hours, identify all systems running Progress Telerik UI for ASP.NET AJAX versions prior to v2026.2.708 and implement network segmentation to restrict remote access to DialogHandler functionality. Within 7 days, disable DialogHandler features for non-essential applications, isolate affected systems from untrusted networks, and subscribe to Telerik security advisories to track v2026.2.708 availability. Within 30 days, deploy v2026.2.708 or later across all affected deployments and validate patching through security scanning.

Telerik UI CVE-2026-13187

EUVD-2026-47692 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-07-22 ProgressSoftware

GHSA-jpmx-7c66-9jwf

Information Disclosure Telerik Ui For Asp Net Ajax Progress Software

8.1

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

DialogHandler is a network-reachable unauthenticated endpoint (AV:N/PR:N), but reliably tampering the provider type for full impact needs extra conditions (AC:H); unsafe reflection can yield high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:33 vuln.today

CVE Published

Jul 22, 2026 - 13:40 cve.org

HIGH 8.1

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.

AnalysisAI

Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the DialogHandler's provider type input to alter dialog processing, serving as a stepping stone for chained exploitation. The flaw stems from unsafe reflection (CWE-470), where externally-controlled input selects the class/code path handling dialog operations, and carries a CVSS 8.1 (high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Telerik components have a notable history of being targeted once weaponized.

Technical ContextAI

Telerik UI for ASP.NET AJAX is a widely used suite of server-side UI controls for .NET web applications; the affected surface is DialogHandler, the HTTP handler backing the editor/dialog controls (historically exposed as Telerik.Web.UI.DialogHandler.aspx). The root cause is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, 'Unsafe Reflection'): a 'provider type' value supplied in the request is used to resolve and instantiate a type at runtime. When that type identifier can be tampered with, an attacker can steer the handler toward unintended classes or processing paths. Per the CPE (cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax:*), all versions prior to the fixed v2026.2.708 are in scope. This handler class has historically been the epicenter of severe Telerik issues (e.g., prior deserialization/RCE flaws), which is why type-selection tampering here is significant.

RemediationAI

Vendor-released patch: upgrade Telerik UI for ASP.NET AJAX to v2026.2.708 or later, which is the primary and definitive fix; redeploy affected applications with the updated Telerik.Web.UI assembly rather than only patching the server, since the vulnerable code ships inside each app. Consult the vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-dialoghandler-provider-type-tampering-CVE-2026-13187 for exact guidance. If immediate upgrade is not possible, apply compensating controls at the web tier: restrict or block external access to the DialogHandler endpoint (e.g. Telerik.Web.UI.DialogHandler.aspx) via URL authorization, WAF rules, or reverse-proxy allow-listing so only trusted internal users reach it - trade-off is that dialog/editor features relying on that handler may break for external users; and remove the handler registration if the RadEditor dialogs are not used in the application. Because these are mitigations rather than fixes, treat them as temporary until v2026.2.708 is deployed.