What is CVE-2026-2878?

CVE-2026-2878 is a medium-severity vulnerability in Progress Telerik_ui_for_asp.net_ajax, classified under Insufficient Entropy. CVSS score: 5.3/10. Published 2026-02-25.

How severe is CVE-2026-2878?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Progress Telerik_ui_for_asp.net_ajax

CVE-2026-2878

In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file cont…

EPSS: 0.002 (7.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.

Affected products

Progress Telerik_ui_for_asp.net_ajax
Progress Software Telerik Ui For Asp.net Ajax — versions 2011.2.712

Weakness classification (CWE)

CWE-331 — Insufficient Entropy

References

security@progress.com (vendor-advisory, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-2878?: CVE-2026-2878 is a medium-severity vulnerability in Progress Telerik_ui_for_asp.net_ajax, classified under Insufficient Entropy. CVSS score: 5.3/10. Published 2026-02-25.
How severe is CVE-2026-2878?: Medium severity. CVSS v3 base score is 5.3 out of 10.