Telerik UI Flaw Chain Enables Unauthenticated Remote Code Execution
A chain of four vulnerabilities in Telerik UI for ASP.NET AJAX allows unauthenticated attackers to achieve remote code execution, impacting versions from 2010 to 2026.
Security researchers have uncovered a significant vulnerability chain in Telerik UI for ASP.NET AJAX, a component widely used in enterprise web applications for file uploads. This flaw chain, affecting versions from 2010.1.309 to 2026.2.519, allows unauthenticated attackers to execute remote code on vulnerable servers. Progress Software has released a patch in version 2026.2.708 to address these issues.
The vulnerability chain comprises four distinct CVEs: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. While not all default Telerik deployments are susceptible, the exploitation path is particularly concerning due to its ability to bypass authentication.
At the core of the exploit is CVE-2026-13182, a padding oracle vulnerability within the RadAsyncUpload component's handling of encrypted client states. Telerik uses AES-CBC encryption for its configuration data. A padding oracle attack exploits differences in how an application responds to invalid encrypted data, allowing an attacker to gradually decrypt sensitive information or forge valid encrypted values without possessing the encryption key. Researchers found that even with ASP.NET's customErrors feature enabled, exploitation is possible through timing analysis.
This padding oracle allows attackers to manipulate Telerik’s serialized configuration data, specifically altering the AllowedFileExtensions field to permit the upload of malicious DLL files. The attack employs a CBC forgery technique to maintain legitimate configuration while injecting malicious entries. This enables the upload of arbitrary files, which is a critical step towards achieving code execution.
The second critical vulnerability, CVE-2026-13181, involves Telerik's handling of upload metadata. The component resolves .NET type names from the AsyncUploadTypeName value without a proper allowlist. If a server-side FileUploaded handler reads the UploadResult property, Telerik can deserialize corrupt data into the specified type. This can be chained with the System.Configuration.Install.AssemblyInstaller gadget to load an uploaded DLL, executing native code via its DllMain entry point.
Proof-of-concept demonstrations showed the successful execution of a web shell within the IIS worker process. An in-memory variant of the exploit can also run commands without writing any files to disk, making detection more challenging. Successful exploitation requires an active server-side FileUploaded event handler that reads UploadResult and a configured, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey.
Organizations using Telerik UI for ASP.NET AJAX are strongly advised to upgrade to version 2026.2.708 or later immediately. Administrators should review their applications, particularly pages utilizing the RadAsyncUpload control and its event handlers, for any signs of suspicious activity. Monitoring for unusual process creation (e.g., w3wp.exe spawning cmd.exe), unexpected DLLs in temporary directories, or new .aspx files in web roots is crucial for detecting potential compromise.