Security firm TantoSec published a working exploit chain on September 7 that can let an unauthenticated attacker run remote code on servers hosting vulnerable Telerik UI for ASP.NET AJAX applications. Progress Software fixed the flaws in July, and no confirmed exploitation in the wild has been reported. What changed is that the disclosure pairs a detailed technical walk-through with a ready-to-run command-line tool and two payloads, placing a complete attack path in public hands for the first time.
The chain targets the RadAsyncUpload file-upload control in versions 2010.1.309 through 2026.2.519, which Progress patched in version 2026.2.708 released July 8. The most severe vulnerability, an unguarded type-resolution flaw tracked as CVE-2026-13181, scores 8.1 on the CVSS scale. But running an affected version isn't enough to be exploitable: TantoSec says the chain requires preconditions not met by default installation, including a page that renders a RadAsyncUpload control whose server-side handler reads the upload result, and an application configured with an explicit, non-default encryption key for the control—ironically, a setting Telerik recommends as hardening. Where those conditions hold, the payoff is code execution with the privileges of the IIS application pool. The attack takes roughly 127,000 oracle requests—about an hour against a lab target, and longer against a rate-limited server.
The entry point is a padding oracle (CVE-2026-13182): the control encrypts its client-side state with AES-CBC and no integrity check, so the server responds differently to tampered data depending on whether the decrypted bytes have valid padding or merely fail to parse as JSON. That difference lets an attacker decrypt—and forge—the encrypted upload configuration without ever knowing the key, using a technique TantoSec built around the control's fixed encryption seed. The same forgery allows the attacker to name an arbitrary .NET type, which the control resolves without an allowlist and deserializes into a gadget that loads a DLL from a location the attacker controls. The uploaded DLL is a mixed-mode assembly that runs native code as soon as it loads. TantoSec's Marcio Almeida released a command-line tool, telerik-rau-exploit, along with two mixed-mode DLL payloads—one that writes a web shell to disk and one that runs entirely in memory. If the application hides detailed error messages, the oracle can still be read through response timing, a variant tracked as CVE-2026-13183.
Progress calls upgrading to version 2026.2.708 or later its only official recommendation and warns that a stronger custom key doesn't help, because the oracle never needs the key. The fix replaces the flawed AES-CBC scheme with authenticated encryption and closes the entire chain. For sites that can't upgrade immediately, Progress points to several interim steps: set customErrors to RemoteOnly or On, which forces an attacker onto the slower timing-based variant; disable the upload handler entirely if RadAsyncUpload isn't required; or remove any custom encryption key so the control falls back to the ASP.NET machine key with AES and HMAC. Because Progress warns that successful exploitation leaves no obvious trace in standard ASP.NET error logs, defenders should hunt behaviourally rather than for error signatures: the IIS worker process spawning cmd.exe, a new or unexpected .aspx file in the web root, or a mixed-mode DLL written under the upload control's temporary folder or App_Data. The component has a long history of real-world attacks through older bugs—a 2019 deserialization flaw in the same handler was exploited by ransomware crews and nation-state actors, including in a 2022 breach of a U.S. federal agency, and was still being exploited as recently as 2025. Organizations using any ASP.NET framework with third-party UI components face a structural dilemma: hardening guidance can inadvertently expand attack surface if the underlying cryptographic implementation lacks integrity checks from the start.