CVE-2026-106159 Progress Software CVE debrief

Who should care

Defenders responsible for Progress Kendo UI for jQuery installations, particularly those using the ToolBar ButtonGroup feature, should assess exposure and apply the fix to prevent potential JavaScript injection.

Why it matters

CVE-2026-106159 is a medium-severity vulnerability in Progress Kendo UI for jQuery, allowing an attacker to inject JavaScript via manipulated button URLs, potentially compromising data confidentiality and integrity. Defenders should prioritize verifying affected versions, assessing exposure, and applying the fix.

• Potential JavaScript injection via manipulated button URLs.
• Possible compromise of data confidentiality and integrity.
• Need to verify affected versions and apply the fix.
• Importance of monitoring for suspicious activity related to Kendo UI usage.

Technical summary

The vulnerability occurs in Progress Kendo UI for jQuery versions from 2022.3.1109 to 2026.3.1015. An attacker can manipulate a button URL in the ToolBar ButtonGroup feature to inject JavaScript, potentially compromising data confidentiality and integrity when a user interacts with the affected button. This issue is fixed in version 2026.3.1015. Defenders should prioritize verifying affected versions, assessing exposure, and applying the fix to prevent potential JavaScript injection. The vulnerability allows attackers to execute malicious scripts, impacting applications using the affected feature.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying the fix to prevent potential JavaScript injection.

Recommended defensive actions

• Verify if the installed version of Progress Kendo UI for jQuery is within the affected range (2022.3.1109 to 2026.3.1015).
• Assess exposure by reviewing application usage of Kendo UI ToolBar ButtonGroup features.
• Apply the fixed version (2026.3.1015) to prevent potential JavaScript injection.
• Monitor for suspicious activity related to Kendo UI usage.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, affected versions, and fixed version. The vulnerability occurs in Progress Kendo UI for jQuery versions from 2022.3.1109 to 2026.3.1015. Evidence is based on official CVE Program and NVD sources. Defenders should verify affected versions, assess exposure, and apply the fix to prevent potential JavaScript injection. Limited source detail is available; explicit evidence limits apply.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.