Released exploit chain reaches code execution on Telerik installs hardened with a custom upload key
Progress fixed the chain on July 8, and TantoSec published the method plus a working tool on September 7, so the exposed installs are the ones where an administrator set the explicit upload encryption key Telerik recommends.
The Watch · Security desk
What happened
- TantoSec's Marcio Almeida published the full chain on September 7 along with a command-line tool, telerik-rau-exploit, and two mixed-mode DLL payloads, one dropping a web shell and one running in memory.
- Progress Software had already fixed the flaws, shipping version 2026.2.708 on July 8 and publishing the CVEs and advisory on July 22.
- Exploitation needs two conditions absent from a default install: a page rendering a RadAsyncUpload control whose handler reads the upload result, and an explicit non-default encryption key for that control.
- Where both conditions hold, an unauthenticated attacker gets code execution with the privileges of the IIS application pool.
- There are no confirmed reports of the 2026 flaws being exploited in the wild, and none of them was in CISA's Known Exploited Vulnerabilities catalog as of September 7.
Why it matters
- What it limits constraint A version query cannot close this one. Answering it means knowing which applications render the upload control and which have a custom encryption key in configuration, and most asset inventories record neither.
- Who's exposed exposure The teams that followed Telerik's own hardening advice are the ones in scope; the ones that never set an explicit key are outside this chain entirely.
- What doesn't add up contradiction IONIX's exploitation-attempts claim and the absence of any confirmed case pull the urgency read in opposite directions, and only the second one has evidence attached to it.
- What it sets up precedent The 2019 bug in this same handler was still producing victims six years after its patch, so the working assumption for this chain is a long tail of unpatched installs rather than a short exploitation window.
Next story · Security · Oct 9
SAML role decides which NetScaler appliances Citrix's new RCE flaw can reachConfirmed5 publishers
RadAsyncUpload encrypts its client-side upload configuration with AES-CBC and no integrity check, so the server answers tampered ciphertext differently depending on whether the decrypted bytes have valid padding or merely fail to parse as JSON [9]. That difference is CVE-2026-13182, and it lets an attacker read the blob without the key; because the control derives its encryption from a fixed seed, TantoSec turned reading into writing and forged a configuration of its own [10]. A forged configuration can name any .NET type. The control resolves the name with no allowlist, which is CVE-2026-13181, and deserializes it into a gadget that loads a DLL from a location the attacker controls [11]. The DLL is a mixed-mode assembly, so native code runs the moment it loads [12]. Where the application suppresses detailed errors, the oracle is still readable through response timing, tracked separately as CVE-2026-13183 [16].
None of that is quiet. TantoSec's end-to-end run took roughly 127,000 oracle requests, about an hour against a lab target and longer against a rate-limited server [15]. An hour for 127,000 requests is about 35 per second sustained against a single upload handler [24]. Rate limiting stretches the clock rather than closing the path [15], which makes request volume the practical detection surface for anyone whose change window is weeks out.
Version scanning gets you part way. The affected range is 2010.1.309 through 2026.2.519, with 2026.2.708 and later fixed [5], roughly sixteen years of releases in scope [23]. What the version does not tell you is which of those applications render a RadAsyncUpload control whose server-side handler reads the upload result, and which have an explicit encryption key set for the control [6]. That second condition is the awkward one, because setting the key is hardening Telerik recommends [7]. An affected install missing either condition is not exploitable through this chain [8].
The tooling landed 61 days after the fix shipped and 47 days after Progress published the CVEs [21][22]. Attack-surface vendor IONIX says on its site that it is tracking ongoing exploitation attempts, but supplies no dates or volumes and does not separate exploitation from ordinary internet scanning of the handler [18]. Treat that as unconfirmed until someone puts a date on it.
The handler's history is with older bugs. CVE-2019-18935, a deserialization flaw in the same component, was chained with a 2017 encryption weakness and used by ransomware crews and nation-state actors, including in a 2022 breach of a U.S. federal agency, and was still being exploited in 2025 [19]. CVE-2026-13181 is scored 8.1 with high attack complexity, and that rating describes the configuration prerequisites, not any difficulty once they are met [13]. For most affected estates the work is a version bump. For the subset with an explicit upload key, the work is finding them before someone else finishes 127,000 requests.
What to watch
- A KEV listing for CVE-2026-13181, 13182 or 13183, which would put federal agencies on a fixed remediation clock.
- Whether IONIX or anyone else attaches dates, volumes or victims to the exploitation-attempts claim.
- Public tooling for the second attack chain covered by Progress's July bulletin, which nobody has published yet.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence82
- Adoption15
- Hype gap+5
- Incentives60
- Confidence68
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Security firm TantoSec published a working exploit chain against Telerik UI for ASP.NET AJAX that allows an unauthenticated attacker to execute remote code on the server hosting a vulnerable application.
- [2]
On September 7, TantoSec's Marcio Almeida published a walk-through of the full chain plus a command-line tool, telerik-rau-exploit, and two mixed-mode DLL payloads: one that writes a web shell to disk and one that runs entirely in memory.
- [3]
Progress Software shipped the fix in version 2026.2.708 (2026 Q2 SP1) on July 8.
- [4]
Progress published the CVEs and advisory on July 22.
- [5]
Per Progress's advisory, the chain affects the RadAsyncUpload file-upload control in versions 2010.1.309 through 2026.2.519; 2026.2.708 and later are fixed.
- [6]
TantoSec says the chain has preconditions not met by a default installation: a page must render a RadAsyncUpload control whose server-side handler reads the upload result, and the application must be configured with an explicit, non-default encryption key for the control.
- [7]
Configuring an explicit, non-default encryption key for the control is a setting Telerik recommends as hardening.
- [8]
Sites running an affected version without both preconditions are not exploitable through this chain.
- [9]
The entry point is a padding oracle, CVE-2026-13182: the control encrypts its client-side state with AES-CBC and no integrity check, so the server responds differently to tampered data depending on whether the decrypted bytes have valid padding or merely fail to parse as JSON.
- [10]
The response difference lets an attacker decrypt the encrypted upload configuration, and with a technique TantoSec built around the control's fixed encryption seed, forge it, without ever knowing the key.
- [11]
The forgery allows the attacker to name an arbitrary .NET type, which the control resolves without an allowlist (CVE-2026-13181) and deserializes into a gadget that loads a DLL from a location the attacker controls.
- [12]
The uploaded DLL is a mixed-mode assembly that runs native code as soon as it loads.
- [13]
CVE-2026-13181, an unguarded type-resolution flaw, carries a CVSS score of 8.1 (high); its high attack-complexity rating reflects the configuration prerequisites rather than any difficulty in exploitation once they are met.
- [14]
Where the preconditions hold, the chain yields code execution with the privileges of the IIS application pool.
- [15]
TantoSec's end-to-end run took roughly 127,000 oracle requests, about an hour against a lab target and longer against a rate-limited server.
- [16]
If the application hides detailed error messages, the oracle can still be read through response timing, a variant tracked as CVE-2026-13183.
- [17]
There are no confirmed reports of the 2026 flaws being exploited in the wild, and none appears in CISA's Known Exploited Vulnerabilities catalog as of September 7.
- [18]
Attack-surface-management vendor IONIX states on its site that it is tracking ongoing exploitation attempts, but gives no dates, volumes or other specifics, and does not distinguish exploitation from ordinary internet scanning of the handler.
- [19]
CVE-2019-18935, a 2019 deserialization flaw in the same handler, was chained with a 2017 encryption weakness and exploited by ransomware crews and nation-state actors, including in a 2022 breach of a U.S. federal agency, and was still being exploited as recently as 2025.
- [20]
Progress's July bulletin covers two separate attack chains: the RadAsyncUpload chain TantoSec detailed, and a second one.
- [21]
The public tooling was released 61 days after Progress shipped the fix.
- [22]
The public tooling was released 47 days after Progress published the CVEs and advisory.
- [23]
The affected version range covers about sixteen years of Telerik releases.
- [24]
Completing roughly 127,000 oracle requests in about an hour requires roughly 35 requests per second sustained against the upload handler.
Sources
2 independent publishers whose own reporting we read for this story.
- Tanto Security
tantosec.com
1 article · September 8, 2026
- thehackernews.comTelerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
2 articles · September 7, 2026
Topics and entities
Topics
- Vulnerability Disclosure
- Padding oracle attacks
- Remote Code Execution Surfaces
- .NET Deserialization Vulnerabilities
Entities
- Progress Software
- Markus Wulftange
- Telerik UI for ASP.NET AJAX
- CISA