In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.
| Vendor | Product | Versions |
|---|---|---|
| progress | telerik ui for asp.net ajax | 2010.1.309 |
Added affected version 2026.2.707 and identified CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) in addition to existing CWE-321.
Initial creation
