Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.
TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.
- CVE-2026-13182 padding oracle in AES-CBC upload state lets attackers forge encrypted configuration without the key
- CVE-2026-13181 unguarded type resolution (CVSS 8.1) enables DLL loading and code execution as the IIS app pool
- Exploitation requires a rendered RadAsyncUpload control and a non-default explicit encryption key; ~127,000 oracle requests needed
- Affected versions 2010.1.309 through 2026.2.519; fixed in 2026.2.708 released July 8, 2026
- No confirmed in-the-wild exploitation; a second RadPersistenceManager chain (CVE-2026-13185/-13186/-13190) lacks a public exploit
- Vendors
- Progress SoftwareTelerik
- Organizations
- Progress SoftwareTelerikTantoSecIONIXCODE WHITE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-18935 | Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
CVE-2026-13181+4 related CVEs | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe… | 8.1 group max | <1% |
From the original article
4 min read at thehackernews.com
A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP. NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.