CVE-2026-13182PATCHED

progress · telerik ui for asp.net ajax

RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.

Affected Products

Vendor	Product	Versions
progress	telerik ui for asp.net ajax	2010.1.309

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-padding-oracle-cve-2026-13182(vendor-advisory)

Related News (1 articles)

Tier C

VulDB8h ago

CVE-2026-13182 | Progress Telerik UI for ASP.NET AJAX up to 2026.2.707 Client State Processing RadAsyncUpload cleartext transmission

→ No new info (linked only)

CVSS 3.17.5 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

2026.2.708

CWECWE-209

PublishedJul 22, 2026

Last enriched7h agov2

Trending Score36

Source articles1

Independent1

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-8037EXPKEV

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Trending: 91

HIGHCVE-2026-13189

SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX

Trending: 36

HIGHCVE-2026-13184

RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX

Trending: 36

HIGHCVE-2026-13183

RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX

Trending: 36

MEDIUMCVE-2026-14865

XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX

Trending: 32

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jul 22, 2026

Discovered by ZDM

Jul 22, 2026

Updated: affectedVersions, severity, description, cweIds

Jul 22, 2026

Patch Available

Jul 22, 2026

Version History

Last enriched 7h ago

v2Tier C7h ago

Updated affected versions to include 2026.2.707, corrected severity from HIGH to MEDIUM (problematic rating), added CWE-312 for cleartext transmission, and clarified vulnerability mechanism involves cleartext transmission rather than decrypt-vs-parse oracle.

affectedVersionsseveritydescriptioncweIds

via VulDB

v18h ago

Initial creation