CyberRota Analysis
AI-GeneratedTelerik UI for AJAX versions prior to 2026.2.708 are vulnerable due to the absence of a configured Telerik.Upload.ConfigurationHashKey, which can lead to the use of a predictable default key for upload metadata integrity protection. This flaw allows attackers to forge upload metadata, potentially leading to further exploitation of the application. Organizations using this component should prioritize remediation to mitigate the risk of unauthorized access and data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.
Related CVEs
Other vulnerabilities affecting the same vendor(s)