High severity7.5NVD Advisory· Published Jul 22, 2026· Updated Aug 6, 2026
CVE-2026-13182
CVE-2026-13182
Description
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*Range: >=2010.1309,<2026.2.708
- Range: <2026.2.708
Patches
Vulnerability mechanics
References
1- www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-padding-oracle-cve-2026-13182nvdVendor AdvisoryMitigation
News mentions
2- Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit ReleasedThe Hacker News · Sep 7, 2026
- Telerik Flaw Chain Lets Unauthenticated Attackers Turn Padding Oracle Into Remote Code ExecutionCyber Security News · Sep 7, 2026