Anyone running Telerik UI for ASP.NET AJAX who skipped Progress’s July update now faces a working exploit, not a theoretical one. TantoSec released a chain that starts at a padding oracle in the RadAsyncUpload control and ends in unauthenticated remote code execution, complete with a command-line tool and two payload DLLs.
The chain will not fire on every vulnerable install. Both a RadAsyncUpload control with a server-side handler that reads the upload result and an explicit custom encryption key must be present, and that key setting is itself something Telerik recommends as hardening. Affected builds span 2010.1.309 through 2026.2.519; 2026.2.708 and later are safe.
At the core sits CVE-2026-13182: the control encrypts client-side state with AES-CBC and skips integrity checks, so servers answer differently to tampered data that carries valid padding. Attackers work that oracle to decrypt and forge the upload configuration via the control’s fixed seed, then hit CVE-2026-13181 (CVSS 8.1), a type-resolution flaw with no allowlist, to name an arbitrary .NET type that pulls in a mixed-mode DLL. Code then runs with IIS application pool rights. A timing variant, CVE-2026-13183, keeps the oracle readable when apps hide error details, and CVE-2026-13184 concerns a predictable default key in an alternate mode.
The full run needs roughly 127,000 oracle requests, about an hour against a lab target. No live exploitation is confirmed and the flaws are absent from CISA’s catalog as of September 7. History argues for caution: the same handler carried CVE-2019-18935, abused by ransomware crews for years.
Progress says upgrading is the only complete fix ; a stronger key changes nothing, since the oracle never needs it. Until then, hide error messages, disable the upload handler where it is not needed, and hunt for w3wp.exe spawning cmd.exe, fresh .aspx files, or mixed-mode DLLs under App_Data.
