TantoSec published a working exploit chain for Progress Telerik UI for ASP.NET AJAX on September 7, turning a set of patched July flaws into unauthenticated remote code execution on servers that use a specific non-default RadAsyncUpload setup. Progress had already fixed the chain in version 2026.2.708 on July 8 and published the advisories and CVEs on July 22.
The chain leans on AES-CBC padding-oracle behavior: the server answers slightly differently when tampered upload data has valid padding versus malformed JSON, and that leak lets an attacker recover or forge the encrypted upload state. Where a page exposes RadAsyncUpload, reads the result server-side, and uses an explicit encryption key, the result is code execution under the IIS application pool identity.
For deployments that match those prerequisites, the risk is not a theoretical CVE entry but server compromise through a public proof of concept. Apps that use Telerik only in a default or different configuration do not sit in the same exposure class, and the reporting does not show confirmed in-the-wild exploitation.