Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

1. Executive summary

On 2026-09-07, security firm TantoSec published a working, unauthenticated remote-code-execution chain against Progress Telerik UI for ASP.NET AJAX, together with a command-line exploit tool (telerik-rau-exploit) and two mixed-mode DLL payloads — one web-shell dropper, one fully in-memory. The chain combines a padding oracle in the RadAsyncUpload control's AES-CBC client-state encryption (CVE-2026-13182) with an unguarded type-resolution/deserialization flaw (CVE-2026-13181, CVSS 8.1, high) and a timing-based oracle variant (CVE-2026-13183). Progress patched all three in version 2026.2.708 on 2026-07-08; affected versions are 2010.1.309 through 2026.2.519. Exploitation requires a non-default configuration (an explicit, non-default encryption key on a page rendering RadAsyncUpload), and there are no confirmed reports of in-the-wild exploitation of these 2026 CVEs; none appears in CISA's KEV catalog as of 2026-09-07. The bottom line for EMEA financial services: any internet-facing ASP.NET application running an affected Telerik version with the prerequisite configuration now has a complete, weaponised attack path in public hands — patch to 2026.2.708+ and hunt for the oracle-request pattern.

2. Regulatory framing

No specific NIS2 or UK NIS article is directly engaged by this item beyond these DORA duties; the item is a vulnerability disclosure with no confirmed incident.

3. Technical analysis & attack chain

Affected component: RadAsyncUpload file-upload control in Progress Telerik UI for ASP.NET AJAX, versions 2010.1.309 through 2026.2.519. Fixed in 2026.2.708 (2026 Q2 SP1), released 2026-07-08; CVEs and advisory published 2026-07-22.

Confirmed attack chain (per TantoSec's published write-up)

1. Precondition check. The target application must (a) render a page with a RadAsyncUpload control whose server-side handler reads the upload result, and (b) be configured with an explicit, non-default encryption key for the control. TantoSec states these preconditions "are not met by a default installation" — notably, the explicit-key setting is one Telerik itself recommends as hardening. An affected version without both conditions is not exploitable via this chain.
2. Padding oracle (CVE-2026-13182). The control encrypts its client-side state with AES-CBC and applies no integrity check. The server responds differently to tampered ciphertext depending on whether the decrypted bytes have valid padding or merely fail to parse as JSON. That behavioural difference is a classic padding oracle.
3. Decrypt and forge. The attacker uses the oracle to decrypt the encrypted upload configuration, and — using a technique TantoSec built around the control's fixed encryption seed — to forge a valid encrypted configuration without ever knowing the key.
4. Arbitrary type resolution and deserialization (CVE-2026-13181, CVSS 8.1, high). The forged configuration lets the attacker name an arbitrary .NET type. The control resolves it without an allowlist and deserializes it into a gadget that loads a DLL from an attacker-controlled location. The CVSS "high" attack-complexity rating reflects these configuration prerequisites, not difficulty of exploitation once they are met.
5. Payload execution. The uploaded DLL is a mixed-mode assembly that executes native code as soon as it loads. TantoSec released two payloads: one that writes a web shell to disk, and one that runs entirely in memory. Code execution lands with the privileges of the IIS application pool.
6. Timing-oracle fallback (CVE-2026-13183). If the application hides detailed error messages, the oracle can still be read through response timing.

Operational characteristics: TantoSec's end-to-end run took roughly 127,000 oracle requests — about an hour against a lab target, longer against a rate-limited server. This volume profile is the single most useful detection signal.

Exploitation status: No confirmed reports of the 2026 flaws being exploited in the wild, and none appears in CISA's Known Exploited Vulnerabilities catalog as of 2026-09-07. One attack-surface-management vendor, IONIX, states it is "tracking ongoing exploitation attempts" but provides no dates, volumes, or specifics, and does not distinguish exploitation from ordinary internet scanning of the handler — treat that claim as unverified scanning noise, not confirmed exploitation. Single-sourced; verify before enforcement.

Historical context: The RadAsyncUpload handler has a long history of real-world attacks through older bugs, not these — notably a 2019 deserialization flaw in the same handler, CVE-2019-18935. Prior compromise of the component should raise the baseline of concern.

Confidence caveat: The full chain mechanics, request volume, and payload descriptions are single-sourced to TantoSec's write-up as reported by The Hacker News. The existence of the deserialization flaw and the fixed version (2026.2.708) are corroborated by the GitHub Security Advisory (GHSA-p8j7-r543-2gf8) and ANSSI CERT-FR (CERTFR-2026-AVI-0977); the latter also confirms arbitrary remote code execution, remote denial-of-service, and data-confidentiality impact across the Progress Telerik advisory set. No verified reference data was resolved for this item, so the CVSS 8.1 figure for CVE-2026-13181 is as reported by the source and not independently re-assessed by Adverse Trace.

4. Mitigation & containment

P1 — within 24 hours

1. Inventory. Identify all ASP.NET applications embedding Telerik UI for ASP.NET AJAX, versions 2010.1.309–2026.2.519. Prioritise internet-facing IIS hosts.
2. Patch to 2026.2.708 (2026 Q2 SP1) or later. This is the vendor fix for the full chain. Where immediate patching is not possible, treat the version as exposed and apply P1 items 3–4.
3. Hunt for the oracle pattern. Review IIS logs for sustained high-volume requests to the RadAsyncUpload handler (the .ashx-style upload handler path rendered by the control) — on the order of 10⁴–10⁵ requests from a single source over roughly an hour. Any such pattern on an affected version is presumptive exploitation; escalate under your incident process.
4. Check for the configuration precondition. Determine whether any RadAsyncUpload-bearing page uses an explicit, non-default encryption key. Applications without it are not exploitable via this chain; applications with it on an affected version are the priority patch queue.

P2 — within 72 hours

5. Contain confirmed activity. If oracle-pattern traffic or unexpected DLL loads are found: isolate the affected application pool, capture the uploaded DLL and any web shell written to disk for forensic review, rotate the control's encryption key and any credentials reachable from the application pool identity, and rebuild rather than clean where the in-memory payload was used.
6. Rate-limit the handler. The chain took ~127,000 requests and is materially slower against rate-limited servers; WAF or rate-limiting rules on the RadAsyncUpload handler blunt the attack even before patching. Where feasible, restrict handler access to authenticated sessions.
7. Verify web-shell absence. Search web roots on affected hosts for unexpected recently-written shell files.

P3 — within 7 days

8. Confirm patch coverage across all environments including internal-facing applications, and add Telerik version detection to recurring vulnerability scanning.
9. Fold the configuration precondition into resilience testing (DORA Art. 24): ensure penetration tests and scans specifically check for the explicit-key configuration on RadAsyncUpload, since a default-config scan result of "not exploitable" does not hold once the hardening setting is applied.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, file paths) are available in the source material. The source names the exploit tool (telerik-rau-exploit) and payload class (mixed-mode DLL, web shell / in-memory) but provides no hashes, filenames, or network indicators.

Behavioural indicators

6. Detection

The sources contain no file hashes, distinctive payload strings, mutexes, or registry artefacts — the payloads are described only by class (mixed-mode DLL, web shell, in-memory). No YARA rule can be authored without fabricating strings. However, the log-level behavioural indicators above support a Sigma rule.

title: High-volume request pattern to Telerik RadAsyncUpload handler (padding-oracle exploitation)
id: 7c1f2a44-3b9e-4d61-9f0a-8e5c2d7b1a63
status: experimental
description: >
  Detects sustained high-volume requests to a Telerik UI for ASP.NET AJAX
  RadAsyncUpload handler, consistent with the CVE-2026-13182 padding-oracle
  phase of the TantoSec RCE chain (~127,000 requests over ~1 hour).
  References: thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html
references:

  - https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html
author: Adverse Trace
date: 2026-09-07
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
  filter_handler:
    cs-uri-query|contains: 'Telerik.Web.UI.WebResource.axd'
  filter_rau:
    cs-uri-query|contains: 'rau'
  condition: selection and 1 of filter_*
  # Correlate: count requests per source IP to the handler over 1h;
  # threshold alert at >= 10,000 requests/hour per source (lab chain: ~127,000 total).
falsepositives:

  - Legitimate bulk upload operations through RadAsyncUpload controls
  - Internet scanning of the handler (high volume, but typically lower per-request interactivity)
level: high

Note: the handler-path strings above are the standard Telerik upload handler identifiers implied by the component name in the source; validate the exact handler URL pattern in your environment before deployment, as the source does not spell out the full handler path.

7. Sources

• The Hacker News — "Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released" — https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html — 2026-09-07
• ANSSI France CERT — "Multiples vulnérabilités dans Progress Telerik" (CERTFR-2026-AVI-0977) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0977/ — 2026-08-07
• GitHub Security Advisories — "In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities…" (GHSA-p8j7-r543-2gf8) — https://github.com/advisories/GHSA-p8j7-r543-2gf8

8. Adverse Trace position

This is a credible, weaponised, unauthenticated RCE chain against a component with a proven history of real-world compromise (CVE-2019-18935), but its practical risk to EMEA financial services is bounded by two facts: exploitation requires a specific non-default configuration, and there are no confirmed in-the-wild exploits of the 2026 CVEs and no KEV listing as of 2026-09-07 — severity is high (CVE-2026-13181, CVSS 8.1) but not yet an active-threat emergency. The configuration precondition cuts both ways: it shrinks the exposed population, but the explicit-key setting is one Telerik recommends as hardening, so firms that believe they are hardened may in fact be the exploitable population — inventory and configuration verification, not version numbers alone, drive the priority queue. The IONIX "ongoing exploitation attempts" claim is single-sourced and indistinguishable from scanning; do not treat it as confirmed exploitation. We will monitor for KEV listing, confirmed exploitation reports, and any published payload hashes or handler-path specifics, and will reissue this advisory at if either changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.