CVE-2026-108116

HIGHCVSS 7.5

Description

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

Timeline

Published:October 15th, 2026 3:17 PM

Last modified:October 15th, 2026 7:17 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-74

References & Reports

Advisories, patches, and third-party reports

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116

Source: NIST NVD · Data may lag official sources by up to one minute