CVE-2026-108116
Progress Kendo Ui: injection
- Risk score
- 53/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
- Affected
- Progress Kendo Ui before 2026.3.1015
- Fix
- Upgrade Progress Kendo Ui to 2026.3.1015 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Progress Kendo Ui: Yellow, plan it in. In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
The flaws
- CVE-2026-108116: Injection (CVSS 7.5 · EPSS 0%)
- CVE-2026-106163: In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the… (CVSS 6.5 · EPSS 0%)
The fix
Upgrade Progress Kendo Ui: 2026.3.1015 or later on your release line
Who is exposed: Progress Kendo Ui before 2026.3.1015
Where it stands
- No known exploitation
Connects to
- Same weakness: Injection (CWE-74). 199 other warnings in 30 days
- Same product: Earlier Progress Kendo Ui warnings. 11 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
Last activity 15 Oct 2026. Patch Forecast updates every hour.