EUVD-2026-47689
GHSA-xj5r-8wvg-3cxf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network unauthenticated forgery justifies AV:N/PR:N and I:H, but reliance on a non-default missing-machineKey configuration and no direct C/A impact warrants AC:H.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.
AnalysisAI
Cryptographic key predictability in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 lets remote unauthenticated attackers forge integrity-protected upload metadata when Telerik.Upload.ConfigurationHashKey is absent and no explicit machineKey is configured, causing the upload handler to fall back to a predictable default key. This forgery capability is not the end goal but a stepping stone: it unlocks further exploit chains (notably the RAU unauthenticated deserialization chain referenced in the vendor KB). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses Telerik UI for ASP.NET AJAX below v2026.2.708 AND that Telerik.Upload.ConfigurationHashKey is absent AND the ASP.NET machineKey is not explicitly configured (auto-generated/implicit) - only under this combination does the upload metadata integrity check fall back to the predictable default key that can be forged. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 High) scores this purely as an integrity impact with network attack vector, low complexity, and no privileges or user interaction - consistent with an unauthenticated metadata-forgery primitive rather than direct code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an internet-facing ASP.NET application using a vulnerable Telerik UI for AJAX build with no configured ConfigurationHashKey or explicit machineKey. Because the integrity key defaults to a predictable value, the attacker forges valid upload metadata over HTTP without any credentials and submits it to the RadAsyncUpload handler, then leverages the forged metadata to advance into the RAU deserialization chain toward file write or code execution. … |
| Remediation | Vendor-released patch: upgrade Telerik UI for ASP.NET AJAX to v2026.2.708 or later, which corrects the predictable-key fallback; this is the primary and recommended fix per the Progress advisory (https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-unauth-deserialization-chain-cve-2026-13184). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Progress Telerik UI for ASP.NET AJAX in your environment and verify their versions; immediately disable upload functionality or restrict access to trusted networks if the installation predates v2026.2.708. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistenc
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today