Security researchers have identified a critical vulnerability chain in Progress Telerik UI for ASP.NET AJAX, which allows unauthenticated attackers to escalate from a cryptographic padding oracle to remote code execution on exposed web applications.
Documented by Tanto Security researcher Marcio Almeida, this vulnerability affects Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519. To address this issue, Progress Software has released version 2026.2.708, also known as 2026 Q2 SP1.
The attack exploits four reported flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184, all of which are related to Telerik’s RadAsyncUpload component.
The most significant vulnerability is an unauthenticated AES-CBC padding oracle that affects encrypted upload configuration data.
An attacker can repeatedly modify the encrypted input and observe the server’s responses to determine whether the altered ciphertext has valid PKCS#7 padding. This process leaks enough information to decrypt protected data one byte at a time, even without the encryption key.
AES-CBC encryption by itself does not authenticate ciphertext. If an application does not verify the integrity of encrypted data blocks using a message authentication mechanism, an attacker can manipulate them before the application decrypts them.
If the server reacts differently to malformed padding compared to correctly padded but otherwise invalid data, it effectively becomes an oracle. In Telerik’s implementation, this discrepancy can be evident through error messages.
Even with ASP.NET custom errors enabled, attackers may still identify the oracle through differences in response time. However, this makes the attack slower and more complex.
The researchers discovered that the oracle could be used not only to recover the plaintext of encrypted configuration fields but also to forge selected configuration fields. Telerik stores certain RadAsyncUpload settings as UTF-16LE JSON.
Although a static initialization vector limits an attacker’s ability to control the first encrypted block, the researchers were able to bypass this limitation by modifying existing server-issued ciphertext.
They inserted forged JSON data following a controlled “sacrificial” block within a long JSON string, allowing random decrypted data to remain harmless.
This technique enabled attackers to override security-sensitive configuration values, such as the `AllowedFileExtensions` setting. A forged configuration could lead a vulnerable upload handler to accept `.dll` files.
Additionally, the method allows manipulation of fields such as temporary upload directories, provided the attacker obtains genuine encrypted data from a page that hosts the vulnerable RadAsyncUpload control.
The code-execution part of this vulnerability chain stems from unsafe type handling in Telerik’s upload workflow. The `AsyncUploadClientStateConverter` decrypts metadata containing an `AsyncUploadTypeName` field and then passes the attacker-controlled type string to `Type.GetType()`.
When the application’s server-side `FileUploaded` handler reads `UploadResult`, Telerik deserializes attacker-controlled JSON into the resulting .NET type. This behavior, identified as CVE-2026-13181, allows attackers to select deserialization gadgets.
Researchers demonstrated that the `System.Configuration.Install.AssemblyInstaller` class can be misused to load an attacker-controlled assembly from disk by setting its `Path` property.
A specially crafted mixed-mode C++/CLI DLL can execute native code upon loading through `DllMain`, even before normal managed code execution begins.
The published proof-of-concept payloads include a disk-based web shell that attempts to locate the IIS web root and write an ASPX command shell, as well as an in-memory variant that intercepts HTTP requests without creating a persistent file.
Exploitation is not possible against every Telerik deployment. A vulnerable target must expose a page containing RadAsyncUpload, use a specific non-default `Telerik.AsyncUpload.ConfigurationEncryptionKey`, and include a server-side `FileUploaded` handler that accesses `UploadResult`.
Nevertheless, these conditions may be present in enterprise applications that have implemented Telerik’s recommended encryption key hardening guidance.
Organizations using Telerik UI for ASP.NET AJAX are urged to upgrade immediately to version 2026.2.708 or later. They should also identify internet-exposed RadAsyncUpload instances, review upload event handlers, and investigate any suspicious upload metadata, unusual DLL files, or unexpected behavior from the IIS worker process.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…