CVE-2026-19219: RCE in Telerik UI AJAX RadEditor

CVE-2026-19219 concerns an insufficient integrity protection vulnerability in the RadEditor file browser dialog request parameters in Telerik UI for AJAX versions prior to 2026.3.812. It affects web AJAX applications using the RadEditor control with file browsing functionality. An attacker who has obtained access to certain application cryptographic key material can alter dialog parameters and redirect file browser operations to unauthorized folders, potentially causing remote code execution on the server.

The vulnerability is classified with CVSS 8.1 (HIGH) and was officially declared by Progress in the National Vulnerability Database on September 2, 2026. It was further confirmed by a public GitHub signal on November 6, 2026, reporting the existence of repositories declaring exploit content. The requirement for access to application cryptographic key material limits general accessibility, but for attackers possessing them, the risk is significant.

Administrators must urgently verify the versions of Telerik UI for AJAX in use in their applications and proceed with updates to v2026.3.812 or later. It is advisable to increase monitoring of RadEditor access logs, verify the integrity control mechanisms of dialog parameters, and monitor attempts to access unauthorized folders. For applications unable to update immediately, consider mitigations such as temporary disabling of the file browser function until patching.

This vulnerability is particularly relevant for administrators of CMS platforms, enterprise portals, and collaborative applications that rely on Telerik AJAX for document management and online editing. Access to cryptographic materials could be obtained through configuration compromise, backup leaks, or insider threats, making a review of application secrets management necessary.