CVE-2026-106149 Progress Software CVE debrief

Who should care

Defenders responsible for Progress Kendo UI for jQuery deployments, particularly those with user-controlled data in Menu component dataSource fields, should assess exposure and prioritize verification and updates.

Why it matters

CVE-2026-106149 is a medium-severity vulnerability in Progress Kendo UI for jQuery, allowing low-privileged attackers to inject JavaScript event-handler attributes, compromising data confidentiality and integrity in the user's browser context. Defenders should prioritize verification, updates, and neutralization of user-controlled data.

• An attacker can inject JavaScript event-handler attributes, compromising confidentiality and integrity of data accessible in the user's browser context.
• Defenders must verify Kendo UI for jQuery versions and update to v2026.3.1015 or later to prevent exploitation.
• Defenders should review and neutralize user-controlled data in Menu component dataSource fields to prevent injection.

Technical summary

The Menu component in Progress Kendo UI for jQuery prior to v2026.3.1015 constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. This allows an attacker with low privileges to inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu. The vulnerability can compromise the confidentiality and integrity of data accessible in the user's browser context. Defenders should prioritize verifying and updating Kendo UI for jQuery versions to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and updating Kendo UI for jQuery versions to prevent exploitation.

Recommended defensive actions

• Verify Kendo UI for jQuery versions and update to v2026.3.1015 or later
• Review and neutralize user-controlled data in Menu component dataSource fields
• Monitor for suspicious user interactions with the affected Menu component
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and affected versions. Evidence is limited to public sources and may not reflect the full scope or details of the vulnerability. Defenders should verify Kendo UI for jQuery versions and review user-controlled data in Menu component dataSource fields. Additional verification may be necessary based on specific deployment contexts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.