CVE-2026-108116: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Progress Software Kendo UI for jQuery

This vulnerability (CWE-74) affects Progress Kendo UI for jQuery prior to version 2026.3.1015. The issue arises from improper sanitization of filter values in the PivotGrid XMLA transport, which can be manipulated to modify MDX predicates or inject XML markup into SOAP requests. This injection can lead to unauthorized exposure of data accessible via the XMLA connection configured in the application. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

An attacker can exploit this vulnerability remotely without authentication to inject XML markup or alter MDX predicates in SOAP requests, potentially exposing sensitive data accessible through the XMLA connection. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

The vulnerability affects versions prior to 2026.3.1015. Users should upgrade to version 2026.3.1015 or later where this issue is fixed. Since no vendor advisory or patch link is provided in the input, confirm patch availability from Progress Software's official sources before applying. No alternative mitigations are specified.