CVE-2026-106153 Progress Software CVE debrief

Who should care

Defenders responsible for Progress Kendo UI for jQuery deployments should assess exposure and apply patches or workarounds to prevent exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify if Progress Kendo UI for jQuery versions prior to 2026.3.1015 are in use.

Why it matters

CVE-2026-106153 is a MEDIUM-rated vulnerability in Progress Kendo UI for jQuery that allows for JavaScript execution in a user's browser context. Defenders should prioritize assessing exposure and applying patches or workarounds to prevent exploitation.

• An attacker can execute JavaScript in a user's browser context, compromising confidentiality and integrity of accessible data.
• Defenders must verify if Progress Kendo UI for jQuery versions prior to 2026.3.1015 are in use and apply patches or workarounds.
• Defenders should monitor for suspicious activity and implement compensating controls as needed.

Technical summary

The Calendar and MultiViewCalendar month content templates in Progress Kendo UI for jQuery prior to version 2026.3.1015 render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. This allows for JavaScript execution in a user's browser context, compromising confidentiality and integrity of accessible data. Defenders should prioritize assessing exposure and applying patches or workarounds to prevent exploitation.

Defensive priority

Defenders should prioritize assessing exposure and applying patches or workarounds to prevent exploitation.

Recommended defensive actions

• Assess exposure by checking if Progress Kendo UI for jQuery versions prior to 2026.3.1015 are in use.
• Apply patches or workarounds to prevent exploitation.
• Monitor for suspicious activity and implement compensating controls as needed.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability affects Progress Kendo UI for jQuery versions prior to 2026.3.1015. Defenders should verify if Progress Kendo UI for jQuery versions prior to 2026.3.1015 are in use and apply patches or workarounds. The CVE record was published on 2026-10-15T15:17:22.307Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.