Affected Systems

Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519. Exploitation requires non-default configuration: RadAsyncUpload control with custom encryption key and server-side handler reading upload results. Fixed in version 2026.2.708 (July 2024).

Exploitation Status

Public proof-of-concept exploit released by TantoSec on September 7, 2026. No confirmed wild exploitation of these 2026 CVEs (CVE-2026-13181, -13182, -13183, -13184). Not in CISA KEV catalog. Historical exploitation of older Telerik vulnerabilities (CVE-2019-18935) by ransomware and nation-state actors documented through 2025.

Business Impact

Unauthenticated remote code execution with IIS application pool privileges on vulnerable ASP.NET applications. Attack requires ~127,000 oracle requests (approximately 1 hour in lab conditions, longer with rate limiting). Only affects non-default configurations with custom encryption keys. Successful exploitation leaves no trace in standard ASP.NET error logs, complicating detection. Component has history of real-world attacks via older vulnerabilities.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Upgrade Telerik UI for ASP.NET AJAX to version 2026.2.708 (2026 Q2 SP1) or later immediately—Progress states this is the only official mitigation
  • Inventory all ASP.NET applications using Telerik UI to identify instances with RadAsyncUpload controls and custom encryption keys configured
  • If immediate patching is not possible, set customErrors mode to RemoteOnly or On in web.config to force attackers onto slower timing-based oracle variant
  • Disable RadAsyncUpload handler entirely by setting Telerik.Web.DisableAsyncUploadHandler to true if file upload functionality is not required
  • Review IIS logs and application behavior for unusual patterns of repeated requests to Telerik.Web.UI.WebResource.axd handler; note that successful exploitation may not appear in standard ASP.NET error logs

---

# Threat Actor Context

Actor Profile

TantoSec is a security research firm that published a proof-of-concept exploit chain on September 7, 2026, targeting vulnerabilities in Telerik UI for ASP.NET AJAX. The firm's researcher, Marcio Almeida, released detailed technical documentation alongside a command-line tool (telerik-rau-exploit) and two mixed-mode DLL payloads demonstrating unauthenticated remote code execution. TantoSec's disclosure follows Progress Software's July 2024 patch release, providing the first publicly available complete attack path for this vulnerability chain. The research appears motivated by demonstrating the exploitability of cryptographic weaknesses in widely deployed web application components, particularly those with a history of real-world exploitation.

TTPs (Tactics, Techniques, Procedures)

The exploit chain leverages multiple techniques: Initial Access via an AES-CBC padding oracle vulnerability (CVE-2026-13182) in the RadAsyncUpload control, allowing decryption and forgery of encrypted client-side state without key knowledge. The attack exploits a fixed encryption seed to forge upload configurations. Execution is achieved through unguarded .NET type resolution (CVE-2026-13181, CVSS 8.1) enabling arbitrary type deserialization into a gadget that loads attacker-controlled DLLs. The payload is a mixed-mode assembly executing native code upon load, achieving code execution with IIS application pool privileges. A timing-based oracle variant (CVE-2026-13183) bypasses error message suppression. The full chain requires approximately 127,000 oracle requests, taking roughly one hour in lab conditions. Techniques map to T1190 (Exploit Public-Facing Application), T1027 (Obfuscated Files or Information), T1059 (Command and Scripting Interpreter), and T1055 (Process Injection) for in-memory payload execution.

Targets & Patterns

TantoSec's research targets organizations using Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519, specifically affecting software development environments and web applications built on ASP.NET. The vulnerability chain is exploitable only in non-default configurations where: (1) a page renders a RadAsyncUpload control with a server-side handler that reads upload results, and (2) the application uses an explicit, non-default encryption key for the control—ironically a Telerik-recommended hardening measure. Organizations in sectors heavily reliant on ASP.NET web applications, particularly those following vendor hardening guidance, represent the primary at-risk population. While no confirmed wild exploitation of the 2026 CVEs has been reported, the RadAsyncUpload component has been historically targeted by ransomware crews and nation-state actors exploiting older vulnerabilities (CVE-2019-18935), including a 2022 U.S. federal agency breach, making this component a high-value target despite the configuration prerequisites.

Historical Context

The RadAsyncUpload component has an extensive exploitation history predating TantoSec's 2026 disclosure. A 2019 deserialization vulnerability (CVE-2019-18935) chained with a 2017 encryption weakness was actively exploited by ransomware operators and nation-state actors, including in a documented 2022 breach of a U.S. federal agency. Exploitation of CVE-2019-18935 continued as recently as 2025, demonstrating persistent attacker interest in this attack surface. Progress Software's July 2026 bulletin addressed two separate attack chains: the RadAsyncUpload chain detailed by TantoSec and a distinct RCE chain in RadPersistenceManager and RadDockLayout components (CVE-2026-13185, -13186, -13190) credited to CODE WHITE's Markus Wulftange, for which no public exploit exists. The component's track record of real-world attacks explains heightened concern over TantoSec's unauthenticated RCE path, despite no confirmed exploitation of the 2026 vulnerabilities and absence from CISA's KEV catalog as of September 7, 2026.

Defensive Recommendations

  • Immediately upgrade to Telerik UI for ASP.NET AJAX version 2026.2.708 (2026 Q2 SP1) or later, which replaces AES-CBC with authenticated encryption and closes the entire exploit chain—Progress states this is the only official mitigation and that stronger custom keys do not prevent exploitation
  • If immediate patching is not feasible, disable the RadAsyncUpload handler entirely by setting Telerik.Web.DisableAsyncUploadHandler to true if the upload functionality is not business-critical
  • Configure customErrors to RemoteOnly or On in web.config to suppress detailed error messages, forcing attackers onto the slower timing-based oracle variant (CVE-2026-13183) and increasing detection opportunities
  • Monitor IIS logs and network traffic for anomalous patterns indicative of padding oracle attacks: high volumes (100,000+) of requests to RadAsyncUpload handlers with similar payloads, particularly requests generating different response times or error codes
  • Remove custom encryption keys for RadAsyncUpload controls to force fallback to ASP.NET machine keys with AES and HMAC, or manually generate strong machine keys rather than relying on runtime generation—note that successful exploitation leaves no obvious trace in standard ASP.NET error logs, requiring enhanced logging and behavioral detection