CVE-2026-13188

Analyzed Analyzed - Analysis Complete

Dialog Parameter Tampering in Progress Telerik UI for AJAX

Publication date: 2026-07-22

Last updated on: 2026-08-06

Assigner: Progress Software Corporation

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13188

EUVD

EUVD-2026-47693

Affected Vendors & Products

Vendor	Product	Version / Range
progress	telerik_ui_for_asp.net_ajax	From 2011.2712 (inc) to 2026.2.708 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Progress Telerik UI for AJAX versions before v2026.2.708. It involves tampering with DialogHandler request parameters, which could alter server-side dialog behavior and enable further exploitation.

Detection Guidance

Monitor network traffic for unusual DialogHandler requests with tampered parameters. Check server logs for unexpected dialog behavior changes or server-side errors related to DialogHandler processing.

Impact Analysis

An attacker could manipulate DialogHandler parameters to change how dialogs behave on the server side, potentially leading to unauthorized actions or data exposure. The impact is rated as high for integrity (I:H) but low for confidentiality and availability.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by enabling unauthorized server-side behavior changes through tampered DialogHandler parameters. Unauthorized modifications could lead to data integrity issues or unintended access, which are critical concerns under these regulations.

Mitigation Strategies

Update Progress Telerik UI for AJAX to version 2026.2.708 or later immediately. If immediate update is not possible, restrict access to DialogHandler endpoints and validate all incoming DialogHandler request parameters server-side.

Hi! I’m here to help you understand CVE-2026-13188. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70