This vulnerability (CVE-2026-13187) in Progress Software Telerik UI for ASP.NET AJAX prior to version 2026.2.708 allows an attacker to manipulate the DialogHandler provider type input. This manipulation can alter the dialog processing logic, potentially enabling chained exploitation scenarios. The vulnerability is classified under CWE-470, indicating the use of externally-controlled input to select classes or code. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation could lead to full compromise of the affected application, impacting confidentiality, integrity, and availability. The attacker could manipulate dialog processing to execute unauthorized code or actions, potentially leading to further chained exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor Progress Software advisories for updates. Until a patch is available, consider restricting access to affected components and reviewing input validation controls related to dialog handling.