Uncaught Exceptions in Telerik UI for ASP.NET MVC Filter Processing (CVE-2026-106146)
Description
October 2026 - CVE-2026-106146
- Progress® Telerik® UI for ASP.NET MVC
2026.3.1015or earlier.
What Are the Impacts
In Progress® Telerik® UI for ASP.NET MVC versions 2012.2.710 through 2026.3.1015, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version 2026.4.1111.
Issue
- CWE-248: Uncaught Exception
- CAPEC-153: Input Data Manipulation
Solution
The issue is fixed in version 2026.4.1111. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= v2012.2.710 && <= v2026.3.1015 | >= v2026.4.1111 |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for ASP.NET MVC can access their downloads here Product Downloads | Your Account.
Notes
- This issue was identified internally by the Progress Telerik Security Team.
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-106146 (High)
CVSS: 8.6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
In Progress® Telerik® UI for ASP.NET MVC versions 2012.2.710 through 2026.3.1015, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version 2026.4.1111.