Is CVE-2026-13188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13188 being exploited in the wild.

How severe is CVE-2026-13188?

Medium severity, with a CVSS score of 5.9, published 22 July 2026.

Which products and versions are affected?

Progress Software Telerik UI for ASP.NET AJAX 2011.2.712 through 2026.2.519.

Is there a fix for CVE-2026-13188?

A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13188 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13188?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13188: Progress Telerik UI for ASP.NET AJAX parameter tampering in DialogHandler

CVE-2026-13188 · Severity: medium · CVSS 5.9 · Published 2026-07-22

Progress Telerik UI for ASP.NET AJAX, a popular suite of UI components for web applications, contains a vulnerability in its dialog handling system. An attacker could potentially tamper with request parameters to change how the server processes dialogs, such as those used for file management or text editing. This could lead to further attacks that compromise the application's integrity or security controls.

Quick answers

Is CVE-2026-13188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13188 being exploited in the wild.
How severe is CVE-2026-13188?: Medium severity, with a CVSS score of 5.9, published 22 July 2026.
Which products and versions are affected?: Progress Software Telerik UI for ASP.NET AJAX 2011.2.712 through 2026.2.519.
Is there a fix for CVE-2026-13188?: A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13188 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13188?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the DialogHandler component of Telerik UI for ASP.NET AJAX due to insufficient verification of data authenticity (CWE-345). The flaw stems from inadequate integrity protection of dialog request parameters, particularly when using RadEditor or RadFileExplorer components. An unauthenticated remote attacker can manipulate these parameters to influence server-side processing, which may serve as a primitive for chained exploitation. The risk is higher in environments where Telerik.Web.UI.DialogParametersEncryptionKey is set in web.config or where machineKey is not explicitly configured. The issue is addressed in version 2026.2.708 (2026 Q2 SP1) by implementing stronger protection via AES-GCM.

Affected products

Progress Software Telerik UI for ASP.NET AJAX 2011.2.712 through 2026.2.519

Timeline

2026-07-22: advisory
2026-07-22: disclosed
2026-07-22: patched

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-dialoghandler-parameters-tampering-CVE-2026-13188

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.