Server-Side Filter Processing Flaw in Progress Telerik UI for ASP.NET MVC
CVE-2026-106146

8.6HIGH

Key Information:

Vendor

Progress Software
Status
Telerik Ui For Asp.net Mvc
Vendor
CVE Published:
12 November 2026

What is CVE-2026-106146?

An issue in Progress® Telerik® UI for ASP.NET MVC impacts versions from 2012.2.710 to 2026.3.1015 where server-side filter processing fails to adequately validate descriptor types, null values, or stack state within the FilterNodeVisitor. This vulnerability can be exploited by unauthenticated remote attackers through endpoints that accept crafted filter parameters, leading to uncaught exceptions that return HTTP 500 errors, although it does not affect unrelated requests or cause worker-process termination. The vulnerability has been addressed in version 2026.4.1111.

Affected Version(s)

Telerik UI for ASP.NET MVC 2012.2.710 <= 2026.3.1015

References

https://www.telerik.com/aspnet-mvc/documentation/knowledg...
vendor-advisory

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.