CVE-2026-108116

Full vulnerability record from the local CVENow database.

Description

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

Severity

HIGH

CVSS score

7.5 (v3.1)

Vulnerability status

Analyzed

Source identifier

[email protected]

Published

2026-10-15 15:17:22.753000

Last modified

2026-10-20 19:38:26.287000

View original CVE JSON

{
  "id": "CVE-2026-108116",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-15T15:17:22.753",
  "lastModified": "2026-10-20T19:38:26.287",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Progress Software",
          "product": "Kendo UI for jQuery",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2014.2.716",
              "lessThan": "2026.3.1015",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-15T18:11:36.045830Z",
          "id": "CVE-2026-108116",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2014.2.716",
              "versionEndExcluding": "2026.3.1015",
              "matchCriteriaId": "35735089-854D-4B62-8E5B-139DBF6EAA8E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}