What is the CVSS score of CVE-2026-13192?

CVE-2026-13192 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-13192?

Yes, a patch is available for CVE-2026-13192. Update the affected software to the latest version immediately.

Telerik UI AJAX CVE-2026-13192

EUVD-2026-47697 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-22 ProgressSoftware

GHSA-pqm3-3jpc-6f48

SSRF Microsoft Telerik Ui For Asp Net Ajax Progress Software

6.5

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible SSRF requires only low-privilege authentication; confidentiality impact is high due to Windows NTLM credential leakage; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:36 vuln.today

CVE Published

Jul 22, 2026 - 13:44 cve.org

MEDIUM 6.5

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.

AnalysisAI

Server-side request forgery in Progress Telerik UI for ASP.NET AJAX's RadEditor PDF export feature enables authenticated attackers to force the web server to issue outbound HTTP requests to arbitrary attacker-controlled hosts. Because the affected product runs on Windows, those outbound connections can carry Windows NTLM authentication material, exposing credentials for potential relay or offline cracking attacks. The vulnerability affects all versions prior to v2026.2.708 and carries a vendor-confirmed CVSS 6.5 (High confidentiality impact) with no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the RadEditor PDF export pipeline within Progress Telerik UI for ASP.NET AJAX (CPE: cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*), a commercial UI framework for ASP.NET WebForms applications running on Windows IIS. When a PDF is generated from editor content, the server-side renderer fetches embedded resources - images, fonts, stylesheets - referenced by URLs in the submitted markup. CWE-918 (Server-Side Request Forgery) identifies the root cause: the content submitted to this pipeline is not sufficiently validated to prevent attacker-supplied URLs from being resolved by the server process. Because ASP.NET applications on Windows typically run under a domain service account and Windows transparently negotiates NTLM authentication on outbound HTTP requests, a crafted URL pointing to an attacker-controlled SMB or HTTP listener can harvest Net-NTLMv2 challenge-response hashes without any additional user interaction beyond the PDF export trigger.

RemediationAI

Upgrade to Progress Telerik UI for ASP.NET AJAX v2026.2.708 or later, which is the vendor-confirmed fix release per the advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radeditor-pdf-export-ssrf-CVE-2026-13192. If immediate patching is not feasible, consider disabling the RadEditor PDF export feature at the application level to eliminate the vulnerable code path entirely - this is the most effective compensating control, though it removes export functionality for all users. As a secondary mitigation, configure Windows Firewall or network egress controls on the IIS server to block outbound SMB (TCP 445) and restrict outbound HTTP to known-good endpoints, which prevents NTLM credential transmission to attacker-controlled listeners even if the SSRF trigger fires; note this does not remediate the underlying SSRF and may break legitimate PDF rendering that fetches external resources. If the application exposes RadEditor to untrusted or externally-sourced users, consider restricting access to the PDF export endpoint via application-layer authorization until the patch is applied.