CVE-2026-108116: MDX and SOAP Injection in Kendo UI for jQuery

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-20
Weakness: CWE-74

Description

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

Affected products

Progress Software Kendo UI for jQuery: from 2014.2.716 before 2026.3.1015 — fixed in 2026.3.1015

How to fix

Upgrade to a fixed version: Progress Software Kendo UI for jQuery 2026.3.1015. Check the vendor advisory for mitigations.

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116

Get alerted when CVE-2026-108116 or the next vulnerability affects your stack