Canada's Cyber Centre warns Progress Telerik UI for ASP.NET AJAX before 2026.3.812 is affected by path traversal and upload tampering flaws, urging updates.
The Canadian Centre for Cyber Security issued advisory AV26-875 on September 2, 2026, covering vulnerabilities in Progress Software Telerik UI for ASP.NET AJAX prior to version 2026.3.812. Two flaws are listed: CVE-2026-18672, a path traversal in the Telerik Web Forms RadImageEditor, and CVE-2026-19219, a DialogHandler UploadPaths tampering vulnerability. Administrators are encouraged to review the provided links and apply available updates.
Canada's Cyber Centre relayed Schneider Electric advisories for vulnerabilities in NetBotz 5-750/755 (5.5.2 and prior) and PowerChute Serial Shutdown (1.5 and prior).
The Canadian Centre for Cyber Security issued control-systems advisory AV26-871 noting Schneider Electric products affected by vulnerabilities as of September 1, 2026. Affected products include NetBotz 5-750/755 versions 5.5.2 and prior, and PowerChute Serial Shutdown versions 1.5 and prior, the latter with an improper restriction of excessive authentication attempts flaw. Administrators are urged to review Schneider Electric's security notifications and apply the suggested mitigations and updates.
Canada's Cyber Centre warns that multiple Erlang/OTP versions are affected by vulnerabilities and urges administrators to apply updates.
The Canadian Centre for Cyber Security issued advisory AV26-870 on September 1, 2026, noting vulnerabilities affecting Erlang OTP across multiple versions. The bulletin contains no CVE identifiers or exploitation details and directs users and administrators to Erlang's own security advisories to apply necessary updates.
Canada's Cyber Centre flags vulnerabilities across multiple Rockwell Automation ICS products including ControlLogix 5580 and RSLinx Classic.
Canadian Centre for Cyber Security advisory AV26-869, dated September 1, 2026, lists vulnerabilities in Rockwell Automation products: 1756-ENBT Module (all versions), ArmorStart LT (v2.001 and earlier), CompactLogix 5380 / ControlLogix 5580 (V33 and earlier plus several V34-V36 releases), and RSLinx Classic (V4.50 and earlier). It references Rockwell advisories SD1792, SD1794, SD1797, and SD1798 and urges users to apply updates as available.
Canada's Cyber Centre reports Mozilla vulnerabilities fixed in Firefox 155 and Firefox ESR 115.40, 140.15, and 153.2.
Canadian Centre for Cyber Security advisory AV26-868, dated September 1, 2026, notes vulnerabilities in Firefox (versions prior to 155) and Firefox ESR (prior to 115.40, 140.15, and 153.2). The bulletin links to Mozilla's security advisories and urges users and administrators to update. No CVE identifiers or exploitation details are provided.
Canada's Cyber Centre relays a WebPros advisory for CVE-2026-67394, a Plesk privilege escalation flaw to root, fixed in 18.0.79.9 and 18.0.80.5.
The Canadian Centre for Cyber Security issued alert AV26-866 relaying WebPros' security advisory for Plesk. CVE-2026-67394 allows privilege escalation to root and affects Plesk versions prior to 18.0.79.9 and 18.0.80.5. Administrators are encouraged to review the advisory and apply the available updates.
Canada's Cyber Centre warns WatchGuard Dimension and Fireware OS vulnerabilities affect multiple versions and urges administrators to apply available updates.
The Canadian Centre for Cyber Security issued advisory AV26-865 (August 31, 2026) noting that WatchGuard products are affected by vulnerabilities as of August 27, 2026. Affected products include Dimension prior to 2.3.1 and Fireware OS prior to 12.12.2, 12.5.20, and 2026.2.2. Users and administrators are encouraged to review the advisory link and apply updates as they become available.
CISA added actively exploited PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078 to KEV; Canada's Cyber Centre urges Emergency Patch Release 2 for v24-v26.
Canada's Cyber Centre updated security advisory AV26-858, noting PaperCut MF and PaperCut NG versions prior to the v24, v25, and v26 Emergency Patch Release 2 are affected by CVE-2026-81578 and CVE-2026-82078. Open-source reporting indicates both vulnerabilities are being exploited in the wild. In Update 2 (August 31, 2026), CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and the Cyber Centre urges administrators to apply the emergency patches immediately.
Siemens fixed a vulnerability in Element maps-ng V47-V49 (SSA-682041); Canada's Cyber Centre urges administrators to apply the updated releases.
Siemens advisory SSA-682041 addresses a vulnerability affecting Element maps-ng V47 prior to V47.12.3, V48 prior to V48.11.3, and V49 prior to V49.16.1. Canada's Cyber Centre republished the notice (AV26-864) encouraging users and administrators to review the vendor links and apply the necessary updates. No CVSS score or exploitation details were provided in the bulletin.
Dell issued firmware and AppSync security updates for PowerEdge Intel-processor servers (DSA-2026-356, DSA-2026-165); Cyber Centre urges administrators to apply them.
Dell advisories DSA-2026-356 and DSA-2026-165 cover vulnerabilities in Dell PowerEdge server firmware for Intel processors across multiple versions and models, and in Dell AppSync versions up to and including 4.6.0.4 and 4.6.1.0. Canada's Cyber Centre republished the notice (AV26-863) urging users and administrators to review the provided links and apply necessary updates. No exploitation or severity details were included in the bulletin.
Canada's Cyber Centre relayed a cPanel advisory for CVE-2026-65643, a domain parking vulnerability fixed in multiple cPanel/WHM releases; admins should update.
Canada's Cyber Centre issued advisory AV26-861 relaying cPanel's disclosure of CVE-2026-65643, a vulnerability in cPanel's Domain Parking functionality. Affected cPanel & WebHost Manager (WHM) builds include all releases prior to 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and WP2 11.138.1.7. Administrators are urged to review vendor guidance and apply updates. No exploitation details were provided in the advisory.
Canada's Cyber Centre warned that Grafana Alloy versions through 1.18.1 are affected by CVE-2026-19516 and urged users to apply available updates.
Canada's Cyber Centre issued advisory AV26-860 warning that Grafana Alloy versions prior to or equal to 1.18.1 are affected by CVE-2026-19516. The bulletin directs users and administrators to vendor resources and available patches. No exploitation or severity details are included in the advisory text.
Canada's Cyber Centre flagged a use-after-free in Redis 8.0's TLS handling, fixed in versions 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.
Canada's Cyber Centre issued advisory AV26-859 for a use-after-free bug in Redis's tlsProcessPendingData() pending-list iteration, affecting the Redis 8.0 series. Fixed releases include 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1. Users and administrators are encouraged to review vendor guidance and update. No CVE identifier or exploitation details were provided in the advisory text.
Canada's Cyber Centre relays ServiceNow advisories affecting Xanadu, Yokohama, Zurich and Australia releases, urging administrators to patch.
The Canadian Centre for Cyber Security advisory AV26-857 reports that multiple ServiceNow product lines are affected by vulnerabilities: Xanadu prior to Patch 11 Hot Fix 7a, Yokohama prior to Patch 12 Hot Fix 3b and Patch 13 Hot Fix 4, plus multiple Zurich and Australia versions. Administrators are encouraged to review the linked vendor advisories and apply available updates.
Canada's Cyber Centre relayed National Instruments advisories for memory corruption, out-of-bounds read, and out-of-bounds write flaws in LabVIEW versions.
The Canadian Centre for Cyber Security published control systems advisory AV26-856 covering National Instruments LabVIEW. Affected versions include releases before 23.0.0, 23.3.10, 24.3.7, 25.3.5, and 26.3.1. The flaws include memory corruption, an integer conversion out-of-bounds read, and an integer overflow out-of-bounds write. Users and administrators are urged to review the links and apply NI security updates.
Canada's Cyber Centre advisory AV26-855 says Veeam Backup & Replication and Veeam ONE vulnerabilities are resolved in 13.0.3 and 13.1 updates.
Advisory AV26-855, dated August 27, 2026, states that as of August 25 Veeam is affected by vulnerabilities in Backup & Replication (prior to 13.0.3 build 13.0.3.63 and prior to 13.1 build 13.1.0.411) and Veeam ONE (prior to or equal to 13.0.2.6723 and 13.1.0.7034). Fixes are documented in KB4902 (Veeam Backup & Replication 13.1) and KB4905 (Veeam ONE 13.1 Patch 0). The Cyber Centre urges users and administrators to apply the available updates. No CVE identifiers or exploitation details are given.
Canadian Centre for Cyber Security relayed a WebPros advisory covering Plesk vulnerabilities CVE-2026-65642 and CVE-2026-65647 with fixed versions released.
WebPros released a security advisory affecting Plesk versions prior to 18.0.79.8 and 18.0.80.4, Plesk Migrator prior to 2.36.0, and Plesk Site Import prior to 1.12.1. The listed vulnerabilities are CVE-2026-65642 in Plesk's database management interface and CVE-2026-65647 in the Site Import and Migrator extensions. The Canadian Centre for Cyber Security (AV26-854) encourages users and administrators to apply the available updates.
Canada's Cyber Centre relays a SonicWall advisory flagging vulnerabilities in NetExtender Linux Client 3.5 and earlier, urging administrators to apply updates as available.
The Canadian Centre for Cyber Security issued advisory AV26-853, noting SonicWall vulnerabilities affecting NetExtender Linux Client version 3.5 and earlier as of August 25, 2026. The relay provides no CVE identifiers or exploitation details and directs users and administrators to review SonicWall's security advisories and apply updates as they become available.
Canada's Cyber Centre updates Citrix advisory as CVE-2026-8451 and CVE-2026-8452 in NetScaler ADC/Gateway are confirmed exploited in the wild.
The Canadian Centre for Cyber Security updated advisory AV26-645 on August 26, 2026, covering critical vulnerabilities in Citrix NetScaler ADC and Gateway (versions 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, plus FIPS builds). Open-source reporting indicates CVE-2026-8451 and CVE-2026-8452 are being exploited in the wild. Update 3 references related CISA action, and patched builds were released starting June 30, 2026.
Canada's Cyber Centre warns that multiple TeamViewer client products are affected by vulnerabilities, urging users to update to 15.64.7 or later.
Advisory AV26-852, dated August 26, 2026, reports vulnerabilities in TeamViewer Full Client, Host, and QuickSupport across multiple versions and platforms, and in Portable prior to 15.64.7. The Canadian Centre for Cyber Security encourages users and administrators to apply the necessary updates, referencing TeamViewer security bulletins TV-2026-1008 and TV-2026-1009. No exploitation details are provided in the advisory.
Canada's Cyber Centre warns Next.js 15.5 and 16.3 are affected by critical vulnerabilities; users should update to 15.5.24 and 16.3.3.
The Canadian Centre for Cyber Security (AV26-851) warns that Next.js versions 15.5 prior to 15.5.24 and 16.3 prior to 16.3.3 are affected by critical vulnerabilities. Administrators are urged to review the vendor advisory and apply the August 2026 security release updates. The bulletin provides no CVE ids or exploitation details.
Canada's Cyber Centre reports critical vulnerabilities across Ubiquiti UniFi products including UniFi OS Server, Network, Protect, and Access; updates required.
The Canadian Centre for Cyber Security (AV26-850) reports critical vulnerabilities affecting numerous Ubiquiti products, including UniFi OS Server (<=5.1.21), UniFi Network Application (<=10.4.57), UniFi Protect Application (<=7.1.87), and UniFi Access Application (<=4.3.3). Other affected products include UniFi Connect, UID Enterprise Agent, UniFi Talk, UniFi Protect AI Key, Connect Display Cast Pro, and Enterprise Audio/Video Bridge. Administrators should update affected applications and devices; the advisory lists no CVE ids or exploitation details.
Canada's Cyber Centre advises that WatchGuard Agent versions before 1.25.13.0000 are affected by vulnerabilities and urges administrators to apply updates.
The Canadian Centre for Cyber Security relayed WatchGuard's advisory (AV26-847) noting that WatchGuard Agent prior to 1.25.13.0000 is affected by vulnerabilities. Users and administrators are encouraged to review the WatchGuard Endpoint Security Prime advisories and apply the available updates.
Canada's Cyber Centre relayed an OpenSSL advisory (AV26-846) covering vulnerabilities fixed across seven branches, urging users to update to patched releases.
Canadian Centre for Cyber Security bulletin AV26-846 states that OpenSSL is affected by vulnerabilities fixed in 1.0.2zr, 1.1.1zi, 3.0.22, 3.4.7, 3.5.8, 3.6.4, and 4.0.2. Given OpenSSL's ubiquity in TLS stacks, administrators should review the OpenSSL advisories and apply updates. The bulletin includes no exploitation details or CVE identifiers.
CISA added CVE-2026-60004, an actively exploited RCE via diffpatch Git hook installation in Gitea, to the KEV catalog; users should upgrade past 1.27.1.
Canadian Centre for Cyber Security advisory AV26-845 reports that Gitea versions prior to 1.27.1 are affected by CVE-2026-60004, remote code execution via diffpatch Git hook installation. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 25, 2026, indicating observed exploitation. Fixed releases 1.27.1 and 1.27.2 are available, and administrators should upgrade promptly.
Canada's Cyber Centre relays a Google advisory urging updates for Chrome versions prior to 151.0.7922.173 to address vulnerabilities.
The Canadian Centre for Cyber Security issued advisory AV26-844, noting that as of August 20, 2026, Google Chrome prior to version 151.0.7922.173 is affected by vulnerabilities. The Cyber Centre encourages users and administrators to review Google's advisory and apply the necessary updates. No exploitation details or CVE identifiers are provided in the bulletin text.
CISA added actively exploited Oracle flaw CVE-2026-21962 to the KEV catalog; it allows remote unauthorized access to Oracle HTTP Server and WebLogic Proxy Plug-in.
Canada's Cyber Centre updated advisory AV26-042 on Oracle's January 2026 quarterly rollup, reporting that CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026. The flaw affects the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in Oracle Fusion Middleware and may allow a remote attacker to obtain unauthorized access. A public proof of concept has been available since January 21, 2026, and fixes shipped in Oracle's January 20, 2026 advisory covering multiple products.
Canada's Cyber Centre issued advisory AV26-843 covering Dell vulnerabilities requiring updates across Alienware, PowerScale, PowerStore, and other products.
The Canadian Centre for Cyber Security published advisory AV26-843 on August 24, 2026, noting Dell products affected by vulnerabilities as of August 17, 2026. Affected products include Alienware Command Center prior to 6.14.20.0, Dell Command Update prior to 5.7.1, Dell Networking OS10 prior to 10.5.6.14, PowerScale OneFS prior to 14.1, PowerStore OS prior to 5.0.0.2, OpenManage Enterprise prior to 4.7.0, ObjectScale prior to 4.3.0.1, Metro Node prior to 4.6.0.4, and others. Users are directed to apply the vendor's updates.
Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).
· Citrix NetScaler ADC and NetScaler Gateway KEV PoC large
Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.
· MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC ×2mass
Unauthenticated Kernel Crash and Memory Leak in MikroTik RouterOS btest
CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service of MikroTik RouterOS: the service accepts a "related" btest connection before the primary session has completed authentication, so an unauthenticated remote client can start an IPv4 UDP bandwidth test. When the test runs with "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer, leaking a small amount of kernel memory, and a separate unchecked, inverted packet-size interval causes an unsigned integer underflow that produces anomalously large fragmented output capable of restarting the RouterOS kernel. An unauthenticated network attacker therefore gains limited information disclosure and, more significantly, a remote denial of service through repeated router crashes, with no credentials or user interaction required (CVSS 4.0: 8.8 High). Any MikroTik device running an unpatched RouterOS version with the bandwidth-test server enabled and reachable from an untrusted network is affected. No public PoC or CISA KEV listing exists for this CVE and EPSS is low (0.4%), but it is part of the batch of RouterOS fixes in MikroTik advisory AV26-887 that attackers have recently chained to hijack routers, so in-the-wild exploitation of the flaw set is reported.
· MikroTik RouterOS (Long-term channel, v6) All versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS (Long-term channel, v7) All versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC mass
SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x
MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%).
· MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)mass
Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway
CVE-2026-19489 is a vulnerability in Citrix NetScaler ADC and NetScaler Gateway classified as a classic buffer overflow (CWE-120), meaning input is copied into a buffer without adequate size checks; it was disclosed by Citrix alongside CVE-2026-19490, the authentication bypass receiving most of the headline attention. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), the flaw is reachable over the network by an unauthenticated remote attacker with no user interaction, though detailed trigger conditions are not spelled out in the CVE description. The scoring (VC:L/VI:L/VA:H, base 8.8 High) indicates the primary impact is to availability — likely crashes or denial of service on the appliance — with low confidentiality and integrity impact. All organizations running NetScaler ADC or NetScaler Gateway 14.1 releases through build 73.32, or 13.1 releases through build 63.21, fall within the affected ranges. There is no evidence of exploitation so far: the issue is not in CISA KEV, has no known public proof-of-concept, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days (32nd percentile).
· Citrix NetScaler ADC (formerly Citrix ADC) 14.1 releases through build 73.32; 13.1 releases through build 63.21 · Citrix NetScaler Gateway (formerly Citrix Gateway) 14.1 releases through build 73.32; 13.1 releases through build 63.21mass
Authentication Bypass in Check Point SmartConsole Grants Full Admin Access
Check Point SmartConsole, the administrative client used to manage Quantum Security Management and Multi-Domain Security Management, contains an authentication bypass (CWE-287) in its login process that allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. Exploitation is possible when the Management Server IP address is reachable from the internet and the configuration does not restrict Trusted Clients. A successful attacker can modify security policies and security configurations, effectively taking control of firewall management. Any organization running an internet-exposed Check Point management server without Trusted Client restrictions is affected, though Check Point reports exploitation has impacted only a very small number of customers. The flaw was added to CISA's KEV on 2026-07-22, is actively exploited, and press reports indicate public proof-of-concept code has been released.
· Check Point SmartConsole · Check Point Quantum Security Management KEVlarge
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.
OS Command Injection in ConfigServer Security & Firewall (CSF) Allows Root RCE
CVE-2026-65639 is an OS command injection flaw (CWE-78, CVSS 4.0 score 9.5, critical) in the advanced-rule parser of ConfigServer Security & Firewall (CSF), a widely used Linux firewall suite. It is triggered when the parser processes rule data supplied by a configured allow/deny feed: because feed-supplied rule content is not sufficiently validated, an attacker who can control the contents of such a feed (for example by controlling or tampering with the feed source) can inject and execute arbitrary shell commands. Injected commands run as root, so successful exploitation yields full takeover of the host, with high impact to confidentiality, integrity, and availability (the CVSS AT:P metric reflects the precondition that a feed must be configured and attacker-influenced). Affected deployments include versions originally distributed by ConfigServer and versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed the issue in version 16.30, while other independently maintained forks may also be affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and there is no confirmed exploitation in the wild at this time.
· ConfigServer Security & Firewall (CSF) - original distribution · WebPros ConfigServer Security & Firewall (CSF) - WebPros-maintained fork versions containing the vulnerable code prior to the fix; WebPros addressed the vulnerability in version 16.30mass
Authenticated Root RCE via Improper Symlink Handling in Plesk
Plesk, the WebPros hosting control panel, resolves symlinks without verifying their targets before file access (CWE-59, link following), so privileged panel operations can be redirected through an attacker-controlled symlink. The flaw is triggered remotely by an authenticated low-privileged user — for example a tenant account on a shared hosting server — who gets Plesk's privileged file operations to follow a malicious link. A successful attacker executes arbitrary code with root privileges on the hosting server, compromising the control panel, every site it hosts, and the underlying OS. All Plesk deployments are potentially affected, but the specific vulnerable version range is not given in the available data, so operators should consult WebPros advisory AV26-854 for fixed releases. No public PoC, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only about a 0.5% probability of exploitation within 30 days.
Potential RCE in Progress Telerik UI for ASP.NET AJAX via dialog parameter tampering
Progress Telerik UI for ASP.NET AJAX before v2026.3.812 provides insufficient integrity protection (CWE-345) on the dialog request parameters used by the RadEditor file browser, allowing those parameters to be altered. To exploit it, a network attacker must first have obtained certain application encryption key material used to protect the dialog parameters, which drives the high attack complexity; no privileges or user interaction are required. With tampered parameters, the attacker can control which folders the file browser reads from, writes to, and uploads into, enabling arbitrary file uploads (CWE-434) and potentially remote code execution by writing attacker-controlled files into sensitive or web-executable locations. Any web application built with Telerik UI for ASP.NET AJAX in versions prior to 2026.3.812 is affected. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days.
· Progress Software Telerik UI for ASP.NET AJAX (RadEditor file browser dialogs) all versions prior to 2026.3.812large
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.