CVE-2026-14865 Progress Software CVE debrief

Who should care

Users of Progress Telerik UI for AJAX prior to v2026.2.708, operators, platform administrators, vulnerability management teams, and security teams should be aware of this vulnerability and take steps to mitigate it. They should review official advisories, plan vendor-supported updates or mitigations, and implement compensating controls for exposed systems.

Technical summary

The internal LayoutBuilder control in Progress Telerik UI for AJAX prior to v2026.2.708 processes client-state XML without disabling DTD processing. This allows unauthenticated denial of service via recursive XML entity expansion. The CVSS score for this vulnerability is 5.3, and the severity is MEDIUM. Affected product context includes Progress Telerik UI for AJAX versions prior to v2026.2.708.

Defensive priority

Medium priority

Recommended defensive actions

• Inventory and verify affected Progress Telerik UI for AJAX versions
• Apply vendor remediation or upgrade to v2026.2.708 or later
• Implement compensating controls, such as network segmentation and access controls
• Monitor for suspicious activity and exception tracking
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited, but the CVE record and NVD detail provide some information about the vulnerability. The internal LayoutBuilder control in Progress Telerik UI for AJAX prior to v2026.2.708 processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources