PT-2026-63396

CVE-2026-13182

Published

2026-07-22

Updated

2026-09-18

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708

Description The RadAsyncUpload component contains a flaw in client-state processing where the system can distinguish between decryption failures and invalid-JSON parse failures. This behavior creates a decryption oracle, allowing remote attackers to reveal protected metadata values.

Recommendations Update to version 2026.2.708.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-209: Generation of Error Message Containing Sensitive Information

Related identifiers

CVE-2026-13182

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com