CVE-2026-2878

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-2878
In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-insufficient-entropy-cve-2026-2878 Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*
History

26 Feb 2026, 15:23

Type Values Removed Values Added
CPE cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*
First Time Progress
Progress telerik Ui For Asp.net Ajax
References () https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-insufficient-entropy-cve-2026-2878 - () https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-insufficient-entropy-cve-2026-2878 - Mitigation, Vendor Advisory

25 Feb 2026, 15:22

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-25 15:20

Updated : 2026-02-26 15:23

NVD link : CVE-2026-2878

Mitre link : CVE-2026-2878

CVE.ORG link : CVE-2026-2878

JSON object : View

Products Affected

progress

  • telerik_ui_for_asp.net_ajax
CWE
CWE-331

Insufficient Entropy