Status: UPDATED | Advisory ID: CVE-2026-6022
| CVE | CVE-2026-6022 |
| CVSS Score / Version | 7.5 (High) / CVSS v3.1 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high. |
| Affected products | Progress telerik_ui_for_asp.net_ajax |
| Classified as | CWE-400 (Uncontrolled Resource Consumption) |
| Exploitation prediction (EPSS) | 0.29% probability of exploitation in the next 30 days (22% percentile) -- FIRST.org's EPSS model. |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Progress | telerik_ui_for_asp.net_ajax |
| Subsystems | General OT |
| Sectors | Multiple |
In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.
Monitor Progress's web page for any future patch releases. See vendor advisory link below.