Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
Summary: TantoSec published a working exploit chain that turns an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution, releasing a command-line tool and two mixed-mode DLL payloads on September 7. Progress patched the flaws in version 2026.2.708 on July 8 and published the CVEs on July 22, and exploitation requires a non-default configuration where a page renders RadAsyncUpload and the application sets an explicit encryption key.
Key Takeaway: TantoSec's end-to-end run took roughly 127,000 oracle requests, about an hour against a lab target, and the same handler's 2019 deserialization flaw was exploited by ransomware crews and nation-state actors, including a 2022 breach of a U.S. federal agency. Progress warns that successful exploitation leaves no obvious trace in standard ASP.NET error logs, so defenders have to hunt for w3wp.exe spawning cmd.exe rather than for error signatures.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-18935CVE-2026-13181CVE-2026-13182CVE-2026-13183
- Related
- CVE-2019-18935: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021