PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14865 Progress Software CVE debrief

CVE-2026-14865 is a denial of service vulnerability in Progress Telerik UI for AJAX prior to v2026.2.708. The internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion. This vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Users of Progress Telerik UI for AJAX prior to v2026.2.708 should be aware of this vulnerability and take steps to mitigate it. Affected product deployments should be identified, and owners should be assigned for follow-up.

Vendor
Progress Software
Product
Telerik UI for ASP.NET AJAX
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-08-06
Advisory published
2026-07-22
Advisory updated
2026-08-06

Who should care

Users of Progress Telerik UI for AJAX prior to v2026.2.708, operators, platform administrators, vulnerability management teams, and security teams should be aware of this vulnerability and take steps to mitigate it. They should review official advisories, plan vendor-supported updates or mitigations, and implement compensating controls for exposed systems.

Technical summary

The internal LayoutBuilder control in Progress Telerik UI for AJAX prior to v2026.2.708 processes client-state XML without disabling DTD processing. This allows unauthenticated denial of service via recursive XML entity expansion. The CVSS score for this vulnerability is 5.3, and the severity is MEDIUM. Affected product context includes Progress Telerik UI for AJAX versions prior to v2026.2.708.

Defensive priority

Medium priority

Recommended defensive actions

  • Inventory and verify affected Progress Telerik UI for AJAX versions
  • Apply vendor remediation or upgrade to v2026.2.708 or later
  • Implement compensating controls, such as network segmentation and access controls
  • Monitor for suspicious activity and exception tracking
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited, but the CVE record and NVD detail provide some information about the vulnerability. The internal LayoutBuilder control in Progress Telerik UI for AJAX prior to v2026.2.708 processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-14865 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-14865

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-14865 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-14865

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.