Is CVE-2026-14932 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14932 being exploited in the wild.

How severe is CVE-2026-14932?

Medium severity, with a CVSS score of 6.5, published 22 July 2026.

Which products and versions are affected?

Progress Software Telerik UI for ASP.NET AJAX >= 2009.1.311, <= 2026.2.519.

Is there a fix for CVE-2026-14932?

A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14932 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14932?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14932: Progress Telerik UI for ASP.NET AJAX file read and deletion in RadChart

Q: Is there a fix for CVE-2026-14932?

A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-14932 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-14932?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14932 · Severity: medium · CVSS 6.5 · Published 2026-07-22

Telerik UI for ASP.NET AJAX is a suite of UI components used to build web applications. A vulnerability in the older RadChart component allows an unauthenticated attacker to remotely read or delete image files (such as .png or .jpg) from the application's server directory. While sensitive configuration files like web.config are not accessible, this could lead to data loss or unauthorized access to proprietary images.

Quick answers

Is CVE-2026-14932 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14932 being exploited in the wild.
How severe is CVE-2026-14932?: Medium severity, with a CVSS score of 6.5, published 22 July 2026.
Which products and versions are affected?: Progress Software Telerik UI for ASP.NET AJAX >= 2009.1.311, <= 2026.2.519.
Is there a fix for CVE-2026-14932?: A patch was published on 2026-07-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14932 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14932?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the ChartImage.axd HTTP handler of the obsolete RadChart component. It is caused by the use of a hardcoded cryptographic key (CWE-321) combined with improper path limitation (CWE-22). An unauthenticated remote attacker can exploit this to read or delete files with image extensions (.png, .gif, .jpg, .bmp) within the application directory. The attack is possible if the handler is registered in the web.config and accessible over the network. The issue is resolved in version 2026.2.708; users are advised to upgrade or migrate to RadHtmlChart.

Affected products

Progress Software Telerik UI for ASP.NET AJAX >= 2009.1.311, <= 2026.2.519

Timeline

2026-07-22: disclosed
2026-07-22: advisory
2026-07-22: patched

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radchart-hardcoded-key-file-read-cve-2026-14932

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.