Description
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
Published: 2026-10-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Patch Now
AI Analysis

Impact

The vulnerability allows attackers to send specially crafted filter values in the PivotGrid XMLA transport, which can alter MDX predicates or inject XML markup into SOAP requests. This can lead to unauthorized disclosure of data available through the configured XMLA connection. The flaw arises from improper neutralization of input during XML processing.

Affected Systems

All installations of Progress Software Kendo UI for jQuery earlier than version 2026.3.1015 are affected. The issue exists in the PivotGrid component when using XMLA transport for data binding.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity flaw. EPSS is less than 1%, suggesting very low current exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an attacker to control or influence the filter values sent to the PivotGrid, typically through a web application that hosts the component. Attackers could then manipulate MDX queries or inject XML to access or expose sensitive data from the back‑end XMLA service.

Generated by OpenCVE AI on October 16, 2026 at 20:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Progress Kendo UI for jQuery to version 2026.3.1015 or later.
  • Validate and sanitize all filter values used in PivotGrid to ensure they contain only expected characters and are properly escaped before being sent to the XMLA transport.
  • Restrict access to the XMLA endpoint so that only authorized, authenticated services can communicate with it, and consider network segmentation to isolate the back‑end service.

Generated by OpenCVE AI on October 16, 2026 at 20:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Progress
Progress kendo Ui
CPEs cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*
Vendors & Products Progress
Progress kendo Ui

Thu, 15 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
Title MDX and SOAP Injection in Kendo UI for jQuery
Weaknesses CWE-74
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Progress Kendo Ui
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-15T18:11:50.463Z

Reserved: 2026-10-09T13:53:55.040Z

Link: CVE-2026-108116

cve-icon Vulnrichment

Updated: 2026-10-15T18:11:42.510Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T15:17:22.753

Modified: 2026-10-20T19:38:26.287

Link: CVE-2026-108116

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T21:00:14Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')