Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
A TantoSec proof-of-concept has created a fully documented and executable exploit chain targeting Telerik UI for ASP.NET AJAX, allowing unauthenticated remote code execution. While no active exploitation has been reported, the vulnerability stems from a padding oracle and a type-resolution flaw, both of which have been patched in version 2026.2.708. The exploit requires a specific configuration – a non-default encryption key – and involves a lengthy process of timing attacks. Progress released a fix in July, and recommends upgrading to the latest version or implementing interim mitigations like disabling the upload handler or using a strong machine key.
A TantoSec proof-of-concept has created a fully documented and executable exploit chain targeting Telerik UI for ASP.NET AJAX, allowing unauthenticated remote code execution. While no active exploitation has been reported, the vulnerability stems from a padding oracle and a type-resolution flaw, both of which have been patched in version 2026.2.708. The exploit requires a specific configuration – a non-default encryption key – and involves a lengthy process of timing attacks. Progress released a fix in July, and recommends upgrading to the latest version or implementing interim mitigations like disabling the upload handler or using a strong machine key.
Progress Software patched the flaws in version 2026.2.708 (2026 Q2 SP1) on July 8 and published the CVEs and advisory on July 22. The underlying issues are not new, with a 2019 deserialization flaw in the same handler, CVE-2019-18935, having been chained with a 2017 encryption weakness and exploited by ransomware crews and nation-state actors, including in a 2022 breach of a U.S. federal agency, and was still being exploited as recently as 2025.
What changed on September 7 is the disclosure of the method and the tooling: TantoSec's Marcio Almeida walked through the full chain and released a command-line tool, telerik-rau-exploit, along with two mixed-mode DLL payloads – one that writes a web shell to disk and one that runs entirely in memory. The chain affects the RadAsyncUpload file-upload control in versions 2010.1.309 through 2026.2.519, according to Progress's advisory; 2026.2.708 and later are fixed.
The most serious of the bugs, an unguarded type-resolution flaw tracked as CVE-2026-13181, carries a CVSS score of 8.1 ("high"); its "high" attack-complexity rating reflects the configuration prerequisites described below rather than any difficulty in exploitation once they are met. Running an affected version is not enough to be exploitable. TantoSec says the chain has "preconditions that are not met by a default installation": a page must render a RadAsyncUpload control whose server-side handler reads the upload result, and the application must be configured with an explicit, non-default encryption key for the control – which, in a twist, is a setting Telerik recommends as hardening. Sites on an affected version without both conditions are not exploitable through this chain.
Where those conditions hold, the payoff is code execution with the privileges of the IIS application pool. The entry point is a padding oracle (CVE-2026-13182): because the control encrypts its client-side state with AES-CBC and no integrity check, the server responds differently to tampered data depending on whether the decrypted bytes have valid padding or merely fail to parse as JSON. That difference lets an attacker decrypt – and, with a technique TantoSec built around the control's fixed encryption seed, forge – the encrypted upload configuration without ever knowing the key.
The same forgery allows the attacker to name an arbitrary .NET type, which the control resolves without an allowlist (CVE-2026-13181) and deserializes into a gadget that loads a DLL from a location the attacker controls. The uploaded DLL is a mixed-mode assembly that runs native code as soon as it loads. It is not instant: TantoSec's end-to-end run took roughly 127,000 oracle requests – about an hour against a lab target, and longer against a rate-limited server.
If the application hides detailed error messages, the oracle can still be read through response timing, a variant tracked as CVE-2026-13183. Two further points bound the story. Progress's July bulletin actually covers two separate attack chains: the RadAsyncUpload chain TantoSec detailed, and a distinct remote-code-execution chain in the RadPersistenceManager and RadDockLayout components (CVE-2026-13185, -13186 and -13190), credited to CODE WHITE's Markus Wulftange and Progress, for which no public exploit has been released. And within the RadAsyncUpload chain, a fourth bug involving a predictable default key (CVE-2026-13184) applies only to an alternative attack mode the released demonstration did not use.
There are no confirmed reports of the 2026 flaws being exploited in the wild, and none appears in CISA's Known Exploited Vulnerabilities catalog as of September 7. One attack-surface-management vendor, IONIX, states on its site that it is "tracking ongoing exploitation attempts," but it gives no dates, volumes, or other specifics, and does not distinguish exploitation from ordinary internet scanning of the handler. Progress's July bulletin actually covers two separate attack chains: the RadAsyncUpload chain TantoSec detailed, and a distinct remote-code-execution chain in the RadPersistenceManager and RadDockLayout components (CVE-2026-13185, -13186 and -13190), credited to CODE WHITE's Markus Wulftange and Progress, for which no public exploit has been released.