Remote Code Execution Vulnerability in Progress® Telerik® UI for AJAX
CVE-2026-13181

8.1HIGH

Key Information:

Vendor

Progress Software
Status
Telerik Ui For Asp.net Ajax
Vendor
CVE Published:
22 July 2026

What is CVE-2026-13181?

A vulnerability in Telerik UI for AJAX versions earlier than v2026.2.708 allows an attacker to influence AsyncUploadTypeName processing through forged upload metadata. This manipulation can lead to unsafe type resolution, potentially enabling remote code execution in affected environments. It is crucial for users of this product to apply the necessary updates to mitigate the risk associated with this vulnerability.

Affected Version(s)

Telerik UI for ASP.NET AJAX 2010.1.309 < 2026.2.708

References

https://www.telerik.com/products/aspnet-ajax/documentatio...
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcio Almeida of TantoSec
.