Vulnerabilities · 51 days ago

Telerik UI PoC exposes a narrow RCE path

TantoSec published a working exploit chain for Progress Telerik UI for ASP.NET AJAX on September 7, turning a set of patched July flaws into unauthenticated remote code execution on servers that use a specific non-default RadAsyncUpload setup. Progress had already fixed the chain in version 2026.2.708 on July 8 and published the advisories and CVEs on July 22.

The chain leans on AES-CBC padding-oracle behavior: the server answers slightly differently when tampered upload data has valid padding versus malformed JSON, and that leak lets an attacker recover or forge the encrypted upload state. Where a page exposes RadAsyncUpload, reads the result server-side, and uses an explicit encryption key, the result is code execution under the IIS application pool identity.

For deployments that match those prerequisites, the risk is not a theoretical CVE entry but server compromise through a public proof of concept. Apps that use Telerik only in a default or different configuration do not sit in the same exposure class, and the reporting does not show confirmed in-the-wild exploitation.

CVEs in this update

6 CVEs

Across ui for asp.net ajax, Telerik UI for ASP.NET AJAX.

1 critical · 5 high · 0 medium · 0 low

1 in CISA KEV · 1 with EPSS above 1%

1 with functional or packaged public exploit code

Highest severity: CVE-2019-18935 · 9.8 CRITICAL

Highest EPSS: CVE-2019-18935 · 99.7%

Timeline

Sources

1 source covering this story

Entities

Part of the PlainSec briefing for 2026-09-08

Editions

Related stories