Vulnerability · Published Oct 15, 2026 · Assigned by ProgressSoftware
CVE-2026-108116MDX and SOAP Injection in Kendo UI for jQuery
High 7.5
In plain English
A high-severity injection in Kendo UI for jQuery from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 81.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Kendo UI for jQuery | 2014.2.716 – before 2026.3.1015 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N