Researchers at TantoSec published a complete write-up and working exploit tool on September 7 for a chain of vulnerabilities in Telerik UI for ASP.NET AJAX that allows an unauthenticated attacker to execute code on the web server. The underlying bugs were patched by Progress Software in July, but the public release of a ready-to-run demonstration tool puts the full attack path in public hands for the first time.
The chain starts with a padding oracle (CVE-2026-13182) in the RadAsyncUpload file-upload control. Because the control encrypts its client-side configuration with AES-CBC with no integrity check, an attacker can send crafted requests and read server responses to decrypt — and ultimately forge — the upload parameters without ever knowing the key. That forgery lets the attacker name an arbitrary .NET type, which the control resolves without an allowlist (CVE-2026-13181) and deserializes into a gadget that loads a DLL from an attacker-controlled location, achieving code execution with IIS application pool privileges. A timing-based variant of the oracle (CVE-2026-13183) works even when the application hides detailed error messages. TantoSec’s end-to-end run required roughly 127,000 oracle requests — about an hour against a lab target. There are no confirmed reports of in-the-wild exploitation of these specific CVEs. The fix — version 2026.2.708 (2026 Q2 SP1) — replaces the AES-CBC scheme with authenticated encryption, closing the entire chain.
The attack has meaningful preconditions: a page must render a RadAsyncUpload control whose server-side handler reads the upload result, and the application must be configured with an explicit non-default encryption key for the control. Sites without both conditions are not exploitable through this chain. Progress warns that a stronger custom key does not help, because the oracle never needs the key, and that successful exploitation “leaves no obvious trace in standard ASP.NET error logs.”
How to check if you’re affected
Affected versions are Telerik UI for ASP.NET AJAX 2010.1.309 through 2026.2.519. Upgrade to version 2026.2.708 (2026 Q2 SP1) or later, which fixes CVE-2026-13181, CVE-2026-13182, and CVE-2026-13183. If you cannot upgrade immediately, Progress recommends interim hardening steps detailed in their advisory. Defenders should hunt for the IIS worker process (w3wp.exe) spawning cmd.exe, unexpected .aspx files in the web root, or mixed-mode DLLs written under the upload control’s temporary folder.