CVE-2026-106163 Progress Software CVE debrief

Who should care

Defenders responsible for Progress Kendo UI for jQuery deployments should assess exposure and prioritize patching to prevent potential XSS attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and apply the vendor's security patch. Affected organizations should review and update Progress Kendo UI for jQuery to version v2026.3.1015 or later, and implement additional security measures

Why it matters

CVE-2026-106163 is a medium-severity vulnerability in Progress Kendo UI for jQuery that allows an attacker to execute JavaScript in the user's browser due to improper encoding of remotely supplied file and directory names as HTML. Defenders should prioritize verifying and applying the vendor's security patch.

• An attacker could execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.
• Defenders need to verify and apply the vendor's security patch to prevent potential XSS attacks.
• The vulnerability requires verification of affected versions and remediation priority.

Technical summary

The FileBrowser and ImageBrowser components in Progress Kendo UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015 render remotely supplied file and directory names as HTML without proper encoding, allowing an attacker to execute JavaScript in the user's browser. This improper encoding can lead to cross-site scripting (XSS) attacks, compromising the confidentiality and integrity of data accessible to the affected application. Defenders should prioritize verifying and applying the vendor's security patch for Progress Kendo UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015.

Defensive priority

Defenders should prioritize verifying and applying the vendor's security patch for Progress Kendo UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015.

Recommended defensive actions

• Verify and apply the vendor's security patch for Progress Kendo UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015.
• Review and update Progress Kendo UI for jQuery to version v2026.3.1015 or later.
• Implement additional security measures to monitor and protect against potential XSS attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Progress Kendo UI for jQuery, which allows an attacker to execute JavaScript in the user's browser due to improper encoding of remotely supplied file and directory names as HTML.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.