Security researchers have identified a critical vulnerability chain within Telerik UI for ASP.NET AJAX that could allow unauthenticated attackers to achieve remote code execution (RCE) against vulnerable enterprise web applications.
The issue centers on Telerik's RadAsyncUpload component, a widely deployed file-upload control used in ASP.NET WebForms environments. According to Progress Software, the vulnerabilities affect Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519. The issues were resolved in version 2026.2.708, released with the 2026 Q2 SP1 update.
The attack chain consists of four vulnerabilities tracked as CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. Although severe, successful exploitation depends on specific application configurations and does not impact every default Telerik deployment.
At the core of the attack chain is CVE-2026-13182, a padding oracle vulnerability affecting the way RadAsyncUpload processes encrypted client-state data. Telerik uses AES-CBC encryption to protect configuration information exchanged between the server and the client's browser.
A padding oracle vulnerability arises when an application reveals different error messages during the decryption process. In this case, malformed encrypted data generates a different response than correctly padded data containing invalid JSON, providing attackers with valuable feedback.
Exploiting the Padding Oracle
By repeatedly submitting manipulated ciphertext and analyzing application responses, attackers can gradually uncover how the application decrypts data. This process enables them to recover sensitive information and create forged encrypted values without possessing the original encryption key.
Researchers noted that exploitation remains feasible even when ASP.NET's customErrors feature is enabled, although the attack becomes slower and more complex, requiring timing-based analysis.
Using the padding oracle flaw, researchers successfully modified Telerik's serializedConfiguration object, which controls upload component settings. This allowed them to alter the AllowedFileExtensions parameter and authorize uploads of otherwise prohibited DLL files.
The attack leveraged a CBC forgery technique, inserting a specially crafted "sacrificial" encrypted block within a JSON structure. This approach preserved legitimate configuration settings, including session-related controls, while injecting malicious configuration data.
Upload Handling Weakness Enables Code Execution
The second key vulnerability, CVE-2026-13181, affects Telerik's processing of upload metadata. Specifically, the application resolves the .NET type specified through the AsyncUploadTypeName parameter without enforcing a strict allowlist.
If the application contains a server-side FileUploaded event handler that accesses the UploadResult property, Telerik attempts to deserialize uploaded data into the specified type. Researchers demonstrated that this behavior can be abused in conjunction with the System.Configuration.Install.AssemblyInstaller gadget chain, allowing a malicious mixed-mode DLL uploaded to a temporary directory to be loaded and executed through its DllMain entry point.
The proof-of-concept attack successfully executed a web shell within the IIS worker process (w3wp.exe). Researchers also demonstrated an in-memory variation capable of executing commands without writing files to disk.
Conditions Required for Exploitation
Successful exploitation requires several conditions to be met. Attackers must have access to a page containing a RadAsyncUpload control configured with a server-side FileUploaded event handler that reads the UploadResult value.
In addition, the application must be configured with a non-default Telerik.AsyncUpload.ConfigurationEncryptionKey, a setting generally recommended as a security best practice and required for this exploitation pathway.
Mitigation and Detection Recommendations
Organizations using Telerik UI for ASP.NET AJAX should upgrade immediately to version 2026.2.708 or later to eliminate exposure to the vulnerability chain.
Administrators should also identify applications that utilize the RadAsyncUpload component and review associated upload event handlers for insecure implementations or indications of abuse.
Security teams are encouraged to monitor IIS environments for suspicious behavior, including:
- w3wp.exe unexpectedly spawning cmd.exe
- Unexplained DLL files appearing in temporary directories
- Unexpected .aspx files being created within web root directories
- Unusual file upload activity involving executable content
Prompt patching, configuration review, and proactive monitoring are essential to reduce the risk of compromise from this vulnerability chain.
Key Improvements
- Improved readability and flow while preserving technical accuracy.
- Reduced repetition and clarified exploitation steps.
- Organized content into logical sections with headings.
- Enhanced professional tone suitable for security advisories, blogs, and vulnerability reports.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
