What is the CVSS score of EUVD-2026-47687?

EUVD-2026-47687 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Telerik UI for AJAX are affected by EUVD-2026-47687?

Progress Telerik UI for ASP.NET AJAX (versions before 2026.2.708) contains a vulnerability allowing remote attackers to extract protected metadata from web applications' file upload operations…. A patch is available.

How to fix or mitigate EUVD-2026-47687?

Within 24 hours, identify and document all web applications using Progress Telerik UI for ASP.NET AJAX versions before 2026.2.708, particularly those utilizing RadAsyncUpload controls. Within 7 days, deploy Web Application Firewall rules to block requests to vulnerable RadAsyncUpload endpoints, restrict file upload functionality to authenticated users only, or disable the vulnerable control entirely pending patch availability. Within 30 days, monitor Progress security advisories for release of version 2026.2.708 or later, test the update in a staging environment, and plan a phased rollout to all affected applications, prioritizing systems handling sensitive data.

Telerik UI for AJAX EUVD-2026-47687

| CVE-2026-13182 HIGH

Error Message Information Leak (CWE-209)

2026-07-22 ProgressSoftware

GHSA-h9g3-2g32-4pqc

Information Disclosure Oracle Telerik Ui For Asp Net Ajax Progress Software

7.5

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N); AC:H because an oracle attack needs many iterative probes and observable response differences; confidentiality-only disclosure of protected metadata (C:H, I:N, A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:30 vuln.today

CVE Published

Jul 22, 2026 - 13:34 cve.org

HIGH 7.5

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.

AnalysisAI

Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

RadAsyncUpload is the asynchronous file-upload control in Telerik UI for ASP.NET AJAX. It ships an encrypted client-state token (historically 'rauPostData') carrying serialized configuration/metadata such as target folder, allowed extensions, and handler settings. The server decrypts this token and then deserializes/parses the resulting JSON. This flaw is CWE-209 (Information Exposure Through an Error Message / discernible response): the control returns distinguishable behavior for a cryptographic decrypt failure versus a well-formed decryption that yields invalid JSON. That distinction is the classic side channel behind padding-oracle-style attacks against CBC-mode encryption, echoing the well-known historical Telerik RadAsyncUpload weaknesses (e.g., CVE-2017-11317/CVE-2017-11357), where oracle behavior over the encrypted upload configuration exposed protected data.

RemediationAI

Upgrade to Telerik UI for ASP.NET AJAX v2026.2.708 or later (Vendor-released patch: v2026.2.708), which removes the distinguishable-error oracle in RadAsyncUpload client-state processing; then rebuild and redeploy all dependent ASP.NET applications and rotate the Telerik encryption keys/machineKey used to protect upload state since an oracle may have exposed protected values. If immediate patching is not possible, compensating controls include restricting or blocking access to the RadAsyncUpload async-upload handler endpoints (e.g., Telerik.Web.UI.WebResource.axd / the RadAsyncUpload handler) at the WAF or reverse proxy, and rate-limiting or alerting on high-volume repeated POSTs to those handlers to disrupt the many-request oracle probing (trade-off: WAF rules may break legitimate large or bursty uploads and require tuning). Where the upload feature is unused, disable RadAsyncUpload entirely. Follow the vendor guidance at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-padding-oracle-cve-2026-13182.