High severity · published Oct 15, 2026
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KU
Kendo UI for jQuery · Progress Software
2014.2.716 before 2026.3.1015 · source: vendor
KU
Kendo UI · Progress
2014.2.716 before 2026.3.1015 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108116
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108116
Vendor Advisory
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116
More from Kendo UI for jQuery
6.5
CVE-2026-106163
Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
5.4
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
5.4
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
5.4
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip
5.4
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu