What is the CVSS score of EUVD-2026-47688?

EUVD-2026-47688 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Telerik Ui For Asp Net Ajax are affected by EUVD-2026-47688?

Progress Telerik UI for ASP.NET AJAX versions before 2026.2.708 contain a high-severity information disclosure vulnerability (CVE-2026-13183) enabling remote attackers to extract sensitive encrypted…. A patch is available.

How to fix or mitigate EUVD-2026-47688?

Within 24 hours, conduct an inventory of all production systems running Progress Telerik UI for ASP.NET AJAX and confirm versions; implement network segmentation or WAF-level rate limiting on RadAsyncUpload endpoints if immediate patching is not feasible. Within 7 days, deploy WAF rules designed to detect and block timing-based probing against upload metadata endpoints, review and strengthen encryption protocols for sensitive metadata, and contact Progress support for patch availability confirmation and interim guidance. Within 30 days, upgrade all identified systems to Telerik UI v2026.2.708 or later when the patch becomes available, or implement alternative ASP.NET upload components with constant-time cryptographic validation.

Telerik Ui For Asp Net Ajax EUVD-2026-47688

| CVE-2026-13183 HIGH

Observable Timing Discrepancy (CWE-208)

2026-07-22 ProgressSoftware

GHSA-c5xq-jjwj-x369

Information Disclosure Telerik Ui For Asp Net Ajax

7.5

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (ProgressSoftware) · only source for this CVE.

CVSS VectorVendor: ProgressSoftware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:31 vuln.today

CVE Published

Jul 22, 2026 - 13:36 cve.org

HIGH 7.5

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.

AnalysisAI

Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attackers to exploit a timing oracle in RadAsyncUpload's upload metadata processing, recovering protected (encrypted/signed) metadata values through measurable response-time differences during cryptographic validation. The flaw stems from non-constant-time comparison of the metadata's cryptographic integrity, letting an attacker probe validity incrementally. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, conduct an inventory of all production systems running Progress Telerik UI for ASP.NET AJAX and confirm versions; implement network segmentation or WAF-level rate limiting on RadAsyncUpload endpoints if immediate patching is not feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.