EUVD-2026-47692
GHSA-jpmx-7c66-9jwf
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
DialogHandler is a network-reachable unauthenticated endpoint (AV:N/PR:N), but reliably tampering the provider type for full impact needs extra conditions (AC:H); unsafe reflection can yield high C/I/A.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.
AnalysisAI
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the DialogHandler's provider type input to alter dialog processing, serving as a stepping stone for chained exploitation. The flaw stems from unsafe reflection (CWE-470), where externally-controlled input selects the class/code path handling dialog operations, and carries a CVSS 8.1 (high). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target ASP.NET application to expose the Telerik DialogHandler endpoint to the attacker and to be running a version prior to v2026.2.708; the attacker must be able to submit and tamper with the provider type input consumed by DialogHandler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1) describes a network-reachable, unauthenticated (PR:N) vulnerability with no user interaction but HIGH attack complexity, implying the attacker must satisfy non-trivial conditions or win a race/precondition to reliably manipulate the provider type and achieve full C/I/A impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker sends a crafted request to the exposed Telerik DialogHandler endpoint with a tampered 'provider type' parameter, causing the handler to resolve an attacker-influenced type and divert dialog processing. Because attack complexity is HIGH, the attacker likely combines this with additional preconditions or follow-on steps ('chained exploitation') to reach code execution or data access. … |
| Remediation | Vendor-released patch: upgrade Telerik UI for ASP.NET AJAX to v2026.2.708 or later, which is the primary and definitive fix; redeploy affected applications with the updated Telerik.Web.UI assembly rather than only patching the server, since the vulnerable code ships inside each app. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Progress Telerik UI for ASP.NET AJAX versions prior to v2026.2.708 and implement network segmentation to restrict remote access to DialogHandler functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistenc
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today