CVE-2026-14932 Progress Software CVE debrief

Who should care

Users of Progress Telerik UI for AJAX prior to v2026.2.708 should be aware of this vulnerability and take necessary actions to protect their applications.

Technical summary

The CVE-2026-14932 vulnerability is related to the RadChart component in Progress Telerik UI for AJAX. The ChartImage.axd handler in this component allows unauthenticated access, which can lead to file read and deletion of image-extension files within the application directory. This vulnerability has a CVSS score of 6.5 and a severity of MEDIUM.

Defensive priority

High priority should be given to updating Progress Telerik UI for AJAX to v2026.2.708 or later to mitigate this vulnerability, as it is a medium severity vulnerability with a CVSS score of 6.5 and potential for unauthenticated file read and deletion of image-extension files within the application directory. Additionally, users should restrict access to the ChartImage.axd handler and monitor for suspicious activity related to file read and deletion. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Asset inventory and rollback/change windows should also be considered for affected systems. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM, indicating a moderate level of risk. However, given the potential impact of unauthenticated file read and deletion, it is essential to prioritize updates and mitigations. The CVE record and NVD entry provide further details on the vulnerability and its potential impact. Users should review these sources and plan accordingly. The recommended actions include updating Progress Telerik UI for AJAX to v2026.2.708 or later, restricting access to the ChartImage.axd handler, monitoring for suspicious activity related to file read and deletion, reviewing compensating controls for exposed systems, and checking relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory and rollback/change windows should also be considered for affected systems. The goal is to minimize the risk associated with this vulnerability and prevent potential exploitation. By prioritizing updates and mitigations, users can reduce the risk of unauthenticated file read and deletion of image-extension files within the application directory. The vulnerability is related to the RadChart component in Progress Telerik UI for AJAX, and the ChartImage.axd handler allows unauthenticated access, which can lead to file read and deletion of image-extension files within the application directory. Users should be aware of this vulnerability and take necessary actions to

Recommended defensive actions

• Update Progress Telerik UI for AJAX to v2026.2.708 or later
• Restrict access to the ChartImage.axd handler
• Monitor for suspicious activity related to file read and deletion

Evidence notes

The CVE record was published on 2026-07-22T14:17:15.283Z and was last modified on 2026-07-22T20:16:48.487Z. The NVD entry is currently Undergoing Analysis. This information is based on the NVD entry and the CVE record. The vulnerability affects Progress Telerik UI for AJAX prior to v2026.2.708. Users should verify their deployments and plan for updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.