CVE-2026-106158 Progress Software CVE debrief

Who should care

Defenders responsible for Kendo UI for jQuery deployments, especially those using Scheduler Day, Timeline, Month, and Agenda views, should assess exposure and apply the patch. This includes IT security teams, system administrators, and developers who manage or use Progress Kendo UI for jQuery in their applications. They should prioritize verifying exposure, review system configurations, and ensure the patch is applied to prevent potential JavaScript code

Why it matters

CVE-2026-106158 is a medium-severity vulnerability in Progress Kendo UI for jQuery that allows for JavaScript injection via resource color manipulation, potentially compromising data confidentiality and integrity. Defenders should prioritize verifying exposure and applying the patch.

• Data confidentiality and integrity compromise
• JavaScript execution in user's browser
• Potential for unauthorized actions

Technical summary

The vulnerability exists in Progress Kendo UI for jQuery versions 2014.3.1119 through 2026.3.811. An attacker can inject HTML attributes, including event handlers, into quoted event wrapper attributes by controlling a resource color. This leads to JavaScript execution in a user's browser when an affected event is interacted with, compromising data confidentiality and integrity. The issue arises from improper encoding of resource color values in Scheduler Day, Timeline, Month, and Agenda views. Successful exploitation requires user interaction with an affected event.

Defensive priority

Defenders should prioritize verifying exposure in their Kendo UI for jQuery deployments, especially those using Scheduler Day, Timeline, Month, and Agenda views, and apply the patch in version 2026.3.1015.

Recommended defensive actions

• Verify Kendo UI for jQuery version and check for exposure
• Apply patch in version 2026.3.1015
• Review Scheduler Day, Timeline, Month, and Agenda views for vulnerability
• Monitor for suspicious activity related to event interactions
• Perform a thorough review of system logs for potential exploitation attempts
• Inventory affected systems and prioritize patching based on risk
• Track patch deployment and verify successful application of the fix

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. A vendor advisory is available for additional information. The vulnerability affects Progress Kendo UI for jQuery versions 2014.3.1119 through 2026.3.811. Evidence is limited to public CVE and NVD information. Defenders should verify exposure and review Scheduler Day, Timeline, Month, and Agenda views for vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.