High severity7.5NVD Advisory· Published Jul 22, 2026· Updated Aug 6, 2026
CVE-2026-13184
CVE-2026-13184
Description
In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*Range: >=2010.1309,<2026.2.708
- Range: <2026.2.708
Patches
Vulnerability mechanics
References
1News mentions
2- Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit ReleasedThe Hacker News · Sep 7, 2026
- Telerik Flaw Chain Lets Unauthenticated Attackers Turn Padding Oracle Into Remote Code ExecutionCyber Security News · Sep 7, 2026