How severe is CVE-2026-2878?

CVE-2026-2878 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-2878 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-2878?

CVE-2026-2878 affects Progress Telerik Ui For Asp.net Ajax. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-2878?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-2878 have an EU (EUVD) identifier?

Yes. CVE-2026-2878 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-8655.

When was CVE-2026-2878 published?

CVE-2026-2878 was published on 2026-02-25 and last updated on 2026-06-17.

CVE-2026-2878

CVE-2026-2878 is a medium-severity vulnerability in Progress Telerik Ui For Asp.net Ajax with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-331.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-8655
Weakness: CWE-331
Affected product: Progress Telerik Ui For Asp.net Ajax
Published: 2026-02-25
Last modified: 2026-06-17

Description

In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.

Frequently asked questions

What is CVE-2026-2878?: In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.
How severe is CVE-2026-2878?: CVE-2026-2878 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-2878 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-2878?: CVE-2026-2878 affects Progress Telerik Ui For Asp.net Ajax. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-2878?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-2878 have an EU (EUVD) identifier?: Yes. CVE-2026-2878 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-8655.
When was CVE-2026-2878 published?: CVE-2026-2878 was published on 2026-02-25 and last updated on 2026-06-17.

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-insufficient-entropy-cve-2026-2878

Affected products (1)

cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*

More vulnerabilities in Progress Telerik Ui For Asp.net Ajax

CVE-2021-28141 — Critical (CVSS 9.8): An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to…
CVE-2019-19790 — Critical (CVSS 9.8): Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with…
CVE-2017-11357 — Critical (CVSS 9.8): Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which…
CVE-2026-6023 — High (CVSS 8.1): In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to…
CVE-2026-6022 — High (CVSS 7.5): In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption…
CVE-2025-3600 — High (CVSS 7.5): In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that…

All CVEs affecting Progress Telerik Ui For Asp.net Ajax →

Other CWE-331 vulnerabilities

CVE-2020-36925 — Critical (CVSS 9.8): Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that…
CVE-2025-47781 — Critical (CVSS 9.8): Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application…
CVE-2024-47945 — Critical (CVSS 9.8): The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm.…
CVE-2024-25730 — Critical (CVSS 9.8): Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a…
CVE-2023-49599 — Critical (CVSS 9.8): An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit…
CVE-2022-34294 — Critical (CVSS 9.8): totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning…

Browse all CWE-331 vulnerabilities →