CVE-2026-13192: Telerik UI for AJAX SSRF Vulnerability

CVE-2026-13192 Overview

CVE-2026-13192 is a Server-Side Request Forgery (SSRF) vulnerability in Progress® Telerik® UI for AJAX affecting versions prior to v2026.2.708. The flaw resides in the RadEditor PDF export feature, which performs insufficient validation of submitted content. An authenticated attacker can craft input that causes the server to issue outbound HTTP requests to arbitrary hosts. Successful exploitation may expose Windows authentication credentials through forced NTLM handshakes to attacker-controlled endpoints. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can coerce the server into making outbound network connections and potentially leak Windows NTLM credentials to attacker-controlled hosts.

Affected Products

Progress Telerik UI for AJAX versions prior to v2026.2.708
Applications embedding the RadEditor control with PDF export enabled
ASP.NET web applications distributing Telerik UI for AJAX assemblies

Discovery Timeline

2026-07-22 - CVE-2026-13192 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13192

Vulnerability Analysis

The RadEditor control in Telerik UI for AJAX includes a PDF export feature that renders user-supplied HTML content into a PDF document. During rendering, the export pipeline resolves external resources such as images, stylesheets, and remote references embedded in the submitted markup. The vulnerable versions do not adequately validate or restrict the destination hosts for these resource fetches.

An authenticated attacker submits crafted HTML containing references to arbitrary URLs. The server-side renderer then dereferences those URLs from the application host. This behavior converts the application server into a request proxy under partial attacker control.

The impact extends beyond generic SSRF. Because the outbound requests originate from a Windows host, an attacker can direct the server to a Server Message Block (SMB) or HTTP endpoint that solicits NTLM authentication. The server may then transmit the machine account NTLM hash, enabling offline cracking or relay attacks.

Root Cause

The root cause is missing allowlist validation on external resource URIs processed during PDF generation. The PDF export handler trusts content submitted by authenticated editor users and forwards embedded URLs to the underlying rendering engine without host, scheme, or IP filtering.

Attack Vector

Exploitation requires an authenticated session with permission to invoke the RadEditor PDF export. The attacker injects HTML referencing internal services, cloud metadata endpoints, or attacker-controlled hosts. When the server processes the export, it issues outbound requests, which can reveal internal network topology, reach protected intranet services, or trigger credential-leaking authentication exchanges.

No verified public exploit code is available. Refer to the Telerik Security Advisory CVE-2026-13192 for vendor-provided technical details.

Detection Methods for CVE-2026-13192

Indicators of Compromise

Outbound HTTP or SMB connections from IIS worker processes (w3wp.exe) to unexpected external hosts following RadEditor PDF export requests
Web server logs showing repeated POSTs to Telerik PDF export handlers followed by external DNS resolutions
NTLM authentication attempts from the web server to hosts outside the trusted domain boundary
Requests targeting internal IP ranges, 169.254.169.254, or link-local addresses originating from the application server

Detection Strategies

Inspect IIS logs for calls to Telerik PDF export endpoints and correlate with outbound network telemetry from the same process.
Deploy egress filtering rules that alert when the application server initiates connections to non-approved destinations.
Monitor for NTLM authentication traffic leaving the server subnet, which indicates possible credential exfiltration.

Monitoring Recommendations

Enable Windows Firewall outbound logging on servers hosting Telerik UI for AJAX applications.
Forward IIS request logs and process network telemetry to a centralized analytics platform for correlation.
Track user activity within RadEditor sessions, particularly PDF export invocations from low-privilege accounts.

How to Mitigate CVE-2026-13192

Immediate Actions Required

Upgrade Progress Telerik UI for AJAX to v2026.2.708 or later on every application server.
Audit web applications for embedded RadEditor controls with PDF export enabled and inventory their exposure.
Rotate machine account and service account credentials on hosts suspected of exposing NTLM hashes.
Restrict access to editor functionality to trusted authenticated users only.

Patch Information

Progress has released a fixed version in Telerik UI for AJAX v2026.2.708. Apply the update by replacing the Telerik.Web.UI assemblies in affected applications and redeploying. Consult the Telerik Security Advisory CVE-2026-13192 for the official patch guidance and version details.

Workarounds

Disable the PDF export feature of RadEditor where the control is not strictly required.
Enforce strict egress firewall policies that block outbound SMB (TCP 445) and restrict HTTP/HTTPS to allowlisted destinations from web servers.
Block outbound NTLM authentication from application servers using Group Policy settings such as Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers.

bash

# Example Group Policy hardening to block outgoing NTLM to non-domain hosts
# Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
# Setting: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
# Value: Deny all

# Example Windows Firewall rule to block outbound SMB from IIS worker
New-NetFirewallRule -DisplayName "Block w3wp Outbound SMB" `
  -Direction Outbound `
  -Program "C:\Windows\System32\inetsrv\w3wp.exe" `
  -Protocol TCP `
  -RemotePort 445 `
  -Action Block