Is CVE-2026-13187 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13187 being exploited in the wild.

How severe is CVE-2026-13187?

High severity, with a CVSS score of 8.1, published 22 July 2026.

Which products and versions are affected?

Progress Software Telerik UI for ASP.NET AJAX >= 2011.2.712, <= 2026.2.519.

Is there a fix for CVE-2026-13187?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13187 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13187?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13187: Progress Telerik UI for ASP.NET AJAX unsafe reflection in DialogHandler

Q: Is there a fix for CVE-2026-13187?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-13187 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-13187?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13187 · Severity: high · CVSS 8.1 · Published 2026-07-22

Progress Telerik UI for ASP.NET AJAX, a popular suite of UI components for web applications, contains a vulnerability in its dialog handling system. An attacker could potentially manipulate how the application processes dialogs, such as those used for file management or text editing. If successfully exploited, this could lead to unauthorized access to sensitive data or allow the attacker to gain further control over the web server.

Quick answers

Is CVE-2026-13187 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13187 being exploited in the wild.
How severe is CVE-2026-13187?: High severity, with a CVSS score of 8.1, published 22 July 2026.
Which products and versions are affected?: Progress Software Telerik UI for ASP.NET AJAX >= 2011.2.712, <= 2026.2.519.
Is there a fix for CVE-2026-13187?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13187 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13187?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the DialogHandler provider type input of Telerik UI for ASP.NET AJAX due to insufficient validation of externally-controlled input. This flaw, classified as Unsafe Reflection (CWE-470) and Object Injection (CAPEC-586), allows an attacker to tamper with provider type inputs to alter dialog processing. The vulnerability is reachable if RadEditor or RadFileExplorer is used and either a Telerik.Web.UI.DialogParametersEncryptionKey is set or the machineKey is not explicitly configured. While the attack complexity is high, successful exploitation can lead to a full compromise of confidentiality, integrity, and availability. Users are advised to upgrade to version 2026.2.708 or later.

Affected products

Progress Software Telerik UI for ASP.NET AJAX >= 2011.2.712, <= 2026.2.519

Timeline

2026-07-22: advisory
2026-07-22: disclosed

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-dialoghandler-provider-type-tampering-CVE-2026-13187

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.