CVE-2026-2878

Published: Feb 25, 2026Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.

Affected (1)

Products: Progress: Telerik Ui For Asp.net Ajax

1 product

Telerik Ui For Asp.net Ajax

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Progress Telerik Ui For Asp.net Ajax	Before 2026.1.225

Related CWEs

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (1)

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-insufficient-entropy-cve-2026-2878

Source: security@progress.com

MitigationVendor Advisory

Timeline

No history available yet.