High severity7.5NVD Advisory· Published Jul 22, 2026· Updated Aug 6, 2026
CVE-2026-13183
CVE-2026-13183
Description
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*range: >=2010.1309,<2026.2.708
- (no CPE)range: <2026.2.708
Patches
Vulnerability mechanics
References
1- www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-timing-oracle-CVE-2026-13183nvdVendor AdvisoryMitigation
News mentions
2- Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit ReleasedThe Hacker News · Sep 7, 2026
- Telerik Flaw Chain Lets Unauthenticated Attackers Turn Padding Oracle Into Remote Code ExecutionCyber Security News · Sep 7, 2026