The vulnerability exists in Progress Software Telerik UI for ASP.NET AJAX versions prior to 2026.2.708. The upload component signs metadata with a configuration hash key; when the Telerik.Upload.ConfigurationHashKey setting is omitted and the application does not define a machineKey, it falls back to a predictable default key. This cryptographic weakness (CWE‑321) allows an attacker to forge signed metadata, bypassing the integrity check that protects upload data. The impact is that forged metadata can be accepted by the application, potentially leading to broader exploitation within the system.

Installs of Progress Software Telerik UI for ASP.NET AJAX that rely on the default configuration hash key are affected. Any instance using the upload component without setting Telerik.Upload.ConfigurationHashKey in web.config and without an explicit machineKey stanza is vulnerable. Versions older than 2026.2.708 are susceptible.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of <1% suggests a low exploitation probability at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The description does not specify whether authentication is required for the exploitation path, so the exact attack vector is not determined from the data. Nevertheless, because the fallback to a predictable key trivializes the forging of metadata, an attacker who can reach the upload endpoint could potentially exploit the flaw if additional conditions permit.