In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.
| Vendor | Product | Versions |
|---|---|---|
| progress | telerik ui for asp.net ajax | 2010.1.309 |
Severity upgraded to CRITICAL, CVSS score increased to 9.0, and affected versions extended to include 2026.2.707
Initial creation
