CVE-2026-13183

COMPONENT VERSION RANGE

NewScan fingerprints Telerik UI for ASP.NET AJAX from its response and reports this CVE when the detected version falls inside the affected range below.

The variant that survives hiding detailed errors, which is the usual mitigation for CVE-2026-13182. Chained by the released 2026-09-07 public exploit: 13182/13183 recover the upload metadata protection, 13184 supplies the key when the app never set one, and 13181 turns the forged metadata into code execution. Version-match only - the RadAsyncUpload handler answers identically on patched and unpatched builds, and none of the four can be confirmed non-destructively. 13183's own mechanism is a timing oracle; THIS row concludes from a version string, never from a response-time delta (docs/signature-packs.md and the daily-cve no-timing rule).