Quick answers
- Is CVE-2026-13186 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13186 being exploited in the wild.
- How severe is CVE-2026-13186?
- High severity, with a CVSS score of 8.1, published 22 July 2026.
- Which products and versions are affected?
- Progress Software UI for ASP.NET AJAX >= 2013.1.220, <= 2026.2.519.
- Is there a fix for CVE-2026-13186?
- A patch was published on 2026-07-22: Fix released in version 2026.2.708 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13186 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-13186?
- Check whether you run Progress Software UI for ASP.NET AJAX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability (CWE-22) exists in the AppDataStorageProvider of RadPersistenceManager in Telerik UI for ASP.NET AJAX. The flaw occurs when the StorageProviderKey is derived from user-controlled input (e.g., query strings, form fields, or cookies), allowing an attacker to manipulate the file path used for state persistence. By pointing this path to a malicious file—potentially uploaded via other features like RadAsyncUpload—an attacker can trigger insecure deserialization of the file's contents. This chain enables remote code execution (RCE) on the underlying server. The vulnerability is patched in version 2026.2.708 (2026 Q2 SP1).
Affected products
- Progress Software Telerik UI for ASP.NET AJAX >= 2013.1.220, <= 2026.2.519
Timeline
- 2026-07-22: advisory: Initial disclosure by Progress Software
- 2026-07-22: patched: Fix released in version 2026.2.708