Progress Telerik UI for AJAX DialogHandler Parameters Tampering (CVE-2026-13188)

Vulnerability Overview Vulnerability Name: DialogHandler Parameters Tampering Vulnerability (CVE-2026-13188) Description: In Progress Telerik UI for AJAX version 2026.2.519 and earlier, DialogHandler parameters lack sufficient integrity protection, potentially allowing attackers to tamper with server-side dialog processing logic, enabling chained exploitation. Affected Scope Affected Versions: Progress Telerik UI for AJAX version 2026.2.519 and earlier. Specific Conditions: - The application uses RadEditor or RadFileExplorer. - is configured in or but is not explicitly secured. Remediation Upgrade Recommendation Current Version: >= 2011.2.712 & = 2026.2.788 (2026 Q2 SP1) Mitigation Measures If an immediate upgrade is not possible, the following measures can be taken to reduce risk: 1. Use v2026.2.514 and earlier: - Scenario 1: If is used in : - Remove from to fall back to with AES + HMAC. - Continue to follow the instructions in the "Generating Strong Machine Keys" section. - Scenario 2: If is not used: - Continue to follow the instructions in the "Generating Strong Machine Keys" section. 2. Use v2026.2.708 and later: - Option 1: Continue using , which provides stronger protection than (via AES-GCM). - Option 2: Remove and use . Although weaker than GCM, this is useful in web farm environments and allows for "automatic key generation at runtime." Instructions for Generating Strong Machine Keys AES + HMAC Support: Even with strong custom keys, padding oracle attacks cannot be prevented. Keys must be generated manually in IIS, using the same HMAC guard fold as #1 created by Autogenerate. 1. Open IIS > Select your site > Select Machine Key 2. Validation Method: Select HMACSHA256 3. Automatic Generation at Runtime checkbox: Uncheck both options (Important) 4. In the right pane, click Generate Keys 5. In the right pane, click Apply 6. In the left pane, select Application Pools and recycle the relevant App Pool (Important) Notes For any questions or concerns, please open a new technical support case through your Account Thank you to the researchers at TantoSec for the responsible disclosure of this vulnerability. External References CVE-2026-13188: (Medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS: 5.9 / Medium Discoverer Discoverer: Marcio Almeida of TantoSec

Goal Reached Thanks to every supporter — we hit 100%!

Progress Telerik UI for AJAX DialogHandler Parameters Tampering (CVE-2026-13188)