CVE-2026-13181
In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.
- Published Jul 22, 2026
- CVSS 8.1 high
- 0.7% chance of exploitation in the next 30 days (EPSS)
- A fix is available