EUVD-2026-47697
GHSA-pqm3-3jpc-6f48
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible SSRF requires only low-privilege authentication; confidentiality impact is high due to Windows NTLM credential leakage; no integrity or availability impact applies.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.
AnalysisAI
Server-side request forgery in Progress Telerik UI for ASP.NET AJAX's RadEditor PDF export feature enables authenticated attackers to force the web server to issue outbound HTTP requests to arbitrary attacker-controlled hosts. Because the affected product runs on Windows, those outbound connections can carry Windows NTLM authentication material, exposing credentials for potential relay or offline cracking attacks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The RadEditor PDF export feature must be exposed and accessible to the attacker within the target application - this is a non-default feature that must be explicitly integrated by the application developer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a network-accessible, low-complexity SSRF requiring only low-privilege authentication, with high confidentiality impact and no integrity or availability impact - yielding a score of 6.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user - such as a low-privileged application account or an insider - submits crafted HTML content containing an img or link tag pointing to an attacker-controlled server (e.g., an SMB listener running Responder) to the RadEditor component and triggers a PDF export. The ASP.NET worker process on the Windows server fetches the attacker's URL, automatically negotiating NTLM authentication against the listener, which captures the service account's Net-NTLMv2 hash for offline cracking or relay to authenticate against other internal services. … |
| Remediation | Upgrade to Progress Telerik UI for ASP.NET AJAX v2026.2.708 or later, which is the vendor-confirmed fix release per the advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radeditor-pdf-export-ssrf-CVE-2026-13192. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistenc
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today