Security researchers have uncovered a significant vulnerability chain in Telerik UI for ASP.NET AJAX, allowing unauthenticated attackers to execute remote code in vulnerable enterprise web applications.
The issue primarily affects Telerik’s RadAsyncUpload component, a widely used file-upload control in ASP.NET WebForms applications.
Progress Software has indicated that the flaw impacts versions from 2010.1.309 to 2026.2.519. The vulnerability was addressed in version 2026.2.708, released as part of the 2026 Q2 SP1 update.
The vulnerability chain includes four distinct flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. While these vulnerabilities are serious, their exploitation requires specific conditions and cannot be applied universally to all default Telerik deployments.
At the heart of the issue is CVE-2026-13182, a padding oracle vulnerability within RadAsyncUpload’s handling of encrypted client states. Telerik employs AES-CBC encryption to safeguard configuration data exchanged between the server and the user’s browser.
A padding oracle occurs when the application provides different error responses for invalid encrypted data. In this case, malformed data results in a distinct error compared to valid padding with invalid JSON content.
Telerik Flaw Chain
This discrepancy enables an attacker to submit modified ciphertext repeatedly, gathering information on how the application decrypts it, ultimately allowing them to recover sensitive data and forge modified encrypted values without needing the encryption key.
Even when the ASP.NET customErrors feature is enabled, researchers noted that exploitation remains possible, albeit more challenging and time-consuming through timing analysis.
Exploiting this oracle, researchers manipulated Telerik’s serializedConfiguration data, which governs settings within the upload control. This enabled attackers to alter the AllowedFileExtensions field, permitting DLL files to be uploaded.
The attack utilized a CBC forgery technique, introducing a “sacrificial” encrypted block within a JSON string. This method preserved necessary configuration from legitimate page loads, including session controls, while inserting malicious entries in the configuration.
The second critical vulnerability, CVE-2026-13181, pertains to the management of upload metadata, where Telerik resolves the .NET type name supplied via the AsyncUploadTypeName value without a proper allowlist.
If a server-side FileUploaded handler reads the UploadResult property, Telerik deserializes corrupt data into the designated type. This behavior can be exploited together with the System.Configuration.Install.AssemblyInstaller gadget, enabling the application to load an uploaded mixed-mode DLL from a temporary directory, executing native code via its DllMain entry point.
The proof-of-concept demonstrated execution of a web shell within the IIS worker process, while an in-memory variant could run commands without writing any files to disk.
To successfully exploit this vulnerability chain, attackers must access a page containing a RadAsyncUpload control with an active server-side FileUploaded event handler that reads UploadResult.
Additionally, an explicit, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey must be configured for the exploitation path to function, which is recommended as a security measure.
Organizations utilizing Telerik UI for ASP.NET AJAX are urged to upgrade immediately to version 2026.2.708 or later. It is critical for administrators to identify pages using RadAsyncUpload and review their upload event handlers to monitor for potential exploitation.
Vigilance against suspicious IIS activity is also necessary, with particular attention to instances of w3wp.exe unexpectedly spawning cmd.exe, the appearance of DLL files in temporary folders, and unexpected .aspx files in web roots.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Telerik Flaw Chain Lets Unauthenticated Attackers Turn Padding Oracle Into Remote Code Execution appeared first on Cyber Security News.