# Uncaught Exceptions in Telerik UI for ASP.NET MVC Filter Processing (CVE-2026-106146)

## Description

October 2026 - [CVE-2026-106146](https://www.cve.org/CVERecord?id=CVE-2026-106146)

* Progress® Telerik® UI for ASP.NET MVC `2026.3.1015` or earlier.

### What Are the Impacts

In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`.

## Issue

* CWE-248: Uncaught Exception
* CAPEC-153: Input Data Manipulation

## Solution

The issue is fixed in version `2026.4.1111`. The Progress Telerik team strongly recommends upgrading to this version or later.

| Current Version                       | Update to         |
| ------------------------------------- | ----------------- |
| `>= v2012.2.710` && `<= v2026.3.1015` | `>= v2026.4.1111` |

Follow the [update instructions](https://www.telerik.com/aspnet-mvc/documentation/installation/upgrading/upgrade) for precise instructions. All customers who have a license for Progress® Telerik® UI for ASP.NET MVC can access their downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Notes

* This issue was identified internally by the Progress Telerik Security Team.
* If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.

## External References

[CVE-2026-106146](https://www.cve.org/CVERecord?id=CVE-2026-106146) (High)

**CVSS:** 8.6

**Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H`

In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`.