CVE-2026-13187

Analyzed Analyzed - Analysis Complete

Dialog Tampering in Progress Telerik UI for AJAX

Publication date: 2026-07-22

Last updated on: 2026-08-06

Assigner: Progress Software Corporation

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13187

EUVD

EUVD-2026-47692

Affected Vendors & Products

Vendor	Product	Version / Range
progress	telerik_ui_for_asp.net_ajax	From 2011.2712 (inc) to 2026.2.708 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Progress Telerik UI for AJAX versions prior to v2026.2.708. It involves tampering with the DialogHandler provider type input, which could alter how dialogs are processed. This manipulation may enable further exploitation through a chain of attacks.

Detection Guidance

To detect this vulnerability, inspect network traffic for tampered DialogHandler provider type inputs in Telerik UI for AJAX requests. Check server logs for unusual dialog processing patterns or unexpected provider type modifications. Validate that all DialogHandler requests use expected provider types and parameters.

Impact Analysis

An attacker could exploit this to manipulate dialog processing, potentially leading to unauthorized actions or data exposure. The high CVSS score (8.1) indicates significant impact on confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Update Progress Telerik UI for AJAX to version 2026.2.708 or later to address the DialogHandler provider type tampering vulnerability.

Hi! I’m here to help you understand CVE-2026-13187. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70