What is the CVSS score of CVE-2026-13188?

CVE-2026-13188 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13188?

Yes, a patch is available for CVE-2026-13188. Update the affected software to the latest version immediately.

Telerik UI AJAX CVE-2026-13188

EUVD-2026-47693 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-07-22 ProgressSoftware

GHSA-gggw-r635-4jx6

Information Disclosure Telerik Ui For Asp Net Ajax Progress Software

5.9

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

C:L added over vendor's C:N to reflect the 'Information Disclosure' tag; all other metrics consistent with network-accessible, no-auth, high-complexity parameter tampering.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:36 vuln.today

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation.

AnalysisAI

Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.

Technical ContextAI

The DialogHandler in Telerik UI for ASP.NET AJAX (CPE: cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*) is an HTTP handler - typically registered as Telerik.Web.UI.DialogHandler.aspx - that mediates server-side operations for UI controls such as RadEditor, RadFileExplorer, and image/document management dialogs. It processes request parameters that configure dialog behavior: file type filters, allowed paths, rendering modes, and related server-side state. CWE-345 (Insufficient Verification of Data Authenticity) identifies the root cause: the handler does not cryptographically verify or validate the integrity of incoming parameters before acting on them. Because no signing or tamper-evident encoding protects these parameters, an attacker can craft requests with modified values, redirecting dialog logic to unintended server-side states. The CVE tag includes 'Information Disclosure' despite the vendor-supplied CVSS specifying C:N - a discrepancy that warrants vendor clarification, as dialog configuration responses may leak internal path or configuration data as part of the chained exploitation path.

RemediationAI

Upgrade to Progress Telerik UI for ASP.NET AJAX v2026.2.708 or later, which contains the vendor-released patch for CVE-2026-13188 as confirmed by the Progress Software advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-dialoghandler-parameters-tampering-CVE-2026-13188. Where immediate patching is not feasible, restrict network access to the DialogHandler endpoint (Telerik.Web.UI.DialogHandler.aspx) at the web server or perimeter firewall level, limiting requests to trusted internal IP ranges only - note that this will break legitimate dialog functionality for users outside the allowlisted ranges. Additionally, consult the Telerik documentation for any available parameter signing or encryption configuration options that may reduce the parameter tampering surface as a compensating control pending upgrade.