CVE-2026-108116CWE-74

CVE-2026-108116

High · published October 15, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.2th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-10-15T19:17Z
Affected products (1)
ProductVersionsFixed in
progress/kendo_ui≥ 2014.2.716, < 2026.3.10152026.3.1015
References (1)
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116 · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 14:12Z
    MDX and SOAP Injection in Kendo UI for jQuery
    cvelistv5
  • 15 OCT 14:12Z
    MDX and SOAP Injection in Kendo UI for jQuery
    cvelistv5