Full Report
A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild. Security firm TantoSec has published a working exploit chain targeting vulnerabilities
Analysis Summary
# Vulnerability: Telerik UI RadAsyncUpload Deserialization & Padding Oracle Chain
## CVE Details
* **CVE ID:** CVE-2026-13181 (Primary RCE), CVE-2026-13182 (Padding Oracle), CVE-2026-13183 (Timing-based Oracle)
* **CVSS Score:** 8.1 (High)
* **CWE:** CWE-502 (Deserialization of Untrusted Data), CWE-209 (Generation of Error Message Containing Sensitive Information)
## Affected Systems
* **Products:** Telerik UI for ASP.NET AJAX
* **Versions:** 2010.1.309 through 2026.2.519
* **Configurations:** Non-default configuration required for exploitation:
1. A page must render a `RadAsyncUpload` control.
2. The server-side handler must be configured to read the upload result.
3. The application must use an **explicit, non-default encryption key** (ironically a previously recommended hardening step).
## Vulnerability Description
This vulnerability chain leverages an **AES-CBC padding oracle** (CVE-2026-13182) within the `RadAsyncUpload` control. Because the control lacks an integrity check (MAC) on its client-side state, an attacker can analyze server responses to padding errors to decrypt and forge encrypted configurations.
Once the configuration is forged, the attacker exploits an **unguarded type-resolution flaw** (CVE-2026-13181). The control resolves arbitrary .NET types without an allowlist, leading to the deserialization of a malicious gadget. This gadget loads a mixed-mode DLL into memory or onto the disk, resulting in unauthenticated Remote Code Execution (RCE) under the context of the IIS application pool.
## Exploitation
* **Status:** PoC available (TantoSec has released a functional exploit tool: `telerik-rau-exploit`). No confirmed reports of exploitation in the wild.
* **Complexity:** High (Due to specific configuration requirements and the need for ~127,000 oracle requests).
* **Attack Vector:** Network
## Impact
* **Confidentiality:** High (Full access to server data and memory)
* **Integrity:** High (Ability to modify files and system state)
* **Availability:** High (Potential for system takeover or service disruption)
## Remediation
### Patches
* **Upgrade to Telerik UI for ASP.NET AJAX version 2026.2.708 (2026 Q2 SP1) or later.** This version was released on July 8, 2026.
### Workarounds
* Disable the `RadAsyncUpload` control if not strictly necessary.
* Ensure detailed error messages are disabled in production (`customErrors mode="On"`) to mitigate the basic padding oracle, though timing-based attacks (CVE-2026-13183) may still be possible.
* Implement web application firewall (WAF) rules to detect and rate-limit large volumes of requests to the Telerik handler (`Telerik.Web.UI.WebResource.axd`).
## Detection
* **Indicators of Compromise:**
* Large volumes of requests (100,000+) to `Telerik.Web.UI.WebResource.axd` originating from a single IP.
* Unexpected DLL files appearing in temporary ASP.NET directories.
* Unauthorized native code execution within the `w3wp.exe` process.
* **Detection Methods:** Monitor IIS logs for high-frequency requests to the Telerik web resource handler and audit file system changes for suspicious DLL uploads.
## References
* Telerik Advisory: hxxps[://]www[.]telerik[.]com/products/aspnet-ajax/documentation/knowledge-base/kb-security-critical-rce-chain-bulletin-july-2026
* TantoSec Technical Write-up: hxxps[://]tantosec[.]com/blog/2026/09/telerik-padding-oracle-to-shell/
* CVE-2026-13181 Detail: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-13181