CVE-2026-13183 describes a timing side-channel vulnerability in the RadAsyncUpload upload metadata processing of Progress Software's Telerik UI for ASP.NET AJAX prior to version 2026.2.708. The vulnerability allows remote attackers to recover protected metadata values by exploiting measurable timing differences that leak cryptographic validity information. This issue is categorized under CWE-208, indicating an observable timing discrepancy that compromises confidentiality. The CVSS score of 7.5 reflects a high impact on confidentiality with no impact on integrity or availability. The vendor has not yet provided an official fix or remediation level, and no exploits are known in the wild at this time.

The vulnerability can lead to disclosure of protected metadata values by remote attackers through timing analysis, compromising confidentiality. There is no impact on integrity or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Progress Software advisories for updates. Until a patch is available, consider minimizing exposure of the vulnerable component or applying any recommended vendor mitigations once published.