Public exploit exposes Telerik ASP.NET AJAX upload RCE chain

Public tooling follows Telerik ASP.NET AJAX fixes

Security firm TantoSec has released a proof of concept and command-line tool for an unauthenticated remote-code-execution chain affecting Telerik UI for ASP.NET AJAX. The chain targets the RadAsyncUpload control in versions 2010.1.309 through 2026.2.519, while Progress Software fixed the issue in version 2026.2.708, also called 2026 Q2 SP1, on July 8.

The publication on September 7 adds a detailed technical walkthrough, the telerik-rau-exploit tool, and two mixed-mode DLL payloads. One payload writes a web shell to disk, while the other is designed to run in memory. Progress published its CVEs and advisory on July 22.

The disclosed RadAsyncUpload path combines CVE-2026-13182, a padding-oracle issue, with CVE-2026-13181, an unguarded type-resolution flaw rated CVSS 8.1. The resulting code runs with the privileges assigned to the IIS application pool hosting the vulnerable application.

Specific configuration conditions limit exposure

An affected Telerik version alone is not sufficient for exploitation. TantoSec said a page must render a RadAsyncUpload control whose server-side handler reads the upload result, and the application must use an explicit, non-default encryption key for that control. Telerik recommends that custom-key setting as a hardening step, but it is one of the prerequisites for this particular chain.

The control encrypts client-side state with AES-CBC but lacks an integrity check. Server responses differ when altered data has valid padding but cannot be parsed as JSON, versus when the padding itself is invalid. That behaviour provides a padding oracle that can be used to decrypt and forge the encrypted upload configuration without learning the key.

The forged configuration can specify an arbitrary .NET type. Because the control resolves types without an allowlist, an attacker can deserialize a gadget that loads a DLL from an attacker-controlled location. The mixed-mode DLL executes native code as it loads. TantoSec measured roughly 127,000 oracle requests for an end-to-end lab run, taking about an hour and potentially longer where servers rate-limit requests.

Patch status and defensive actions

If detailed errors are hidden, the oracle can still be inferred from response timing; that variant is tracked as CVE-2026-13183. A predictable-default-key issue, CVE-2026-13184, applies to an alternative attack mode that the released demonstration did not use.

Progress's July bulletin also describes a separate remote-code-execution chain affecting RadPersistenceManager and RadDockLayout, tracked as CVE-2026-13185, CVE-2026-13186 and CVE-2026-13190. CODE WHITE's Markus Wulftange and Progress received credit for that work, and no public exploit has been released for it.

There are no confirmed reports that the 2026 vulnerabilities have been exploited in the wild, and they were not listed in CISA's Known Exploited Vulnerabilities catalog as of September 7. The same handler has, however, been involved in older attacks, including exploitation of CVE-2019-18935 chained with a 2017 encryption weakness.

Progress says upgrading to 2026.2.708 or later is its only official recommendation; the release replaces the flawed AES-CBC design with authenticated encryption. Organisations unable to upgrade immediately can set customErrors to RemoteOnly or On, disable the upload handler when RadAsyncUpload is unnecessary, and review encryption-key settings. Security teams should also investigate w3wp.exe launching cmd.exe, unexpected .aspx files in the web root, and mixed-mode DLLs in the upload temporary directory or App_Data. The practical business priority is to identify exposed Telerik deployments, apply the fixed release, and use behavioural monitoring while remediation is underway.