Security researchers have identified a critical vulnerability chain in Telerik UI for ASP.NET AJAX, which enables unauthenticated attackers to execute remote code in affected enterprise web applications. This discovery raises significant concerns for organizations relying on these tools.
Details of the Vulnerability
The vulnerability primarily impacts Telerik’s RadAsyncUpload component, a popular file-upload control used in ASP.NET WebForms applications. According to Progress Software, the flaw affects versions spanning from 2010.1.309 to 2026.2.519, with a patch provided in version 2026.2.708 as part of the 2026 Q2 SP1 update.
The identified vulnerability chain comprises four separate flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. Although serious, these flaws require specific conditions to be exploitable and are not universally applicable across all default Telerik deployments.
Exploitation Mechanics
CVE-2026-13182, a padding oracle vulnerability in RadAsyncUpload’s handling of encrypted client states, is at the core of this issue. Telerik utilizes AES-CBC encryption to protect configuration data exchanged between the server and the client browser. The vulnerability arises when the application provides different error responses for invalid encrypted data, allowing attackers to deduce information about the decryption process.
Researchers demonstrated that by exploiting this oracle, they could manipulate Telerik’s serializedConfiguration data to modify settings, such as the AllowedFileExtensions field, permitting the upload of DLL files. This was achieved using a CBC forgery technique to insert a ‘sacrificial’ encrypted block into a JSON string.
Potential Impact and Recommendations
CVE-2026-13181 is another significant flaw related to the handling of upload metadata. Telerik’s process of resolving the .NET type name via the AsyncUploadTypeName value lacks proper allowlisting, posing a risk when combined with other vulnerabilities. Attackers can exploit this to load mixed-mode DLLs from temporary directories and execute native code.
Proof-of-concept tests demonstrated the execution of a web shell within the IIS worker process and in-memory command execution without disk writes. Successful exploitation requires access to a page with a RadAsyncUpload control, an active FileUploaded event handler, and a configured Telerik.AsyncUpload.ConfigurationEncryptionKey.
Organizations using Telerik UI for ASP.NET AJAX should urgently upgrade to version 2026.2.708 or later. Administrators should audit pages using RadAsyncUpload and scrutinize upload event handlers for potential exploitation signs. Monitoring IIS activity for anomalies such as unexpected cmd.exe processes, DLL files in temporary folders, and unanticipated .aspx files is essential for maintaining security.
For further insights, download the AI SOC Deployment Playbook 2026 and learn about metric-gated AI SOC deployment phases.
