Telerik RadAsyncUpload Exploit Chain Allows Remote Code Execution

Security researchers at TantoSec have published a working exploit chain for the Telerik UI for ASP.NET AJAX web development toolkit that can allow an unauthenticated attacker to run arbitrary code on a hosting server. The attack targets the RadAsyncUpload file-upload control, and Progress Software, which owns Telerik, patched the underlying flaws in version 2026.2.708 on July 8. The public release on September 7 includes a detailed technical write-up, a command-line tool named telerik-rau-exploit, and two payload files, putting a complete attack path into public hands for the first time. However, the chain only works against applications that meet two specific non-default conditions, and there are no confirmed reports of active exploitation in the wild as of September 7.

The vulnerable versions are 2010.1.309 through 2026.2.519, according to Progress's advisory. Simply running an affected version is not enough to be exploitable. TantoSec says the chain has preconditions that are not met by a default installation. First, a page must render a RadAsyncUpload control whose server-side handler reads the upload result. Second, the application must be configured with an explicit, non-default encryption key for the control. That second condition is awkward because Telerik actually recommends setting a custom encryption key as a hardening measure, meaning some well-intentioned configurations may be vulnerable. When both conditions are present, the payoff is code execution with the privileges of the IIS application pool, which is the part of Microsoft's web server software that runs the website's code.

The entry point is a padding oracle, tracked as CVE-2026-13182. The control encrypts its client-side state using AES-CBC, a common encryption method, but does not add an integrity check. As a result, the server responds differently to tampered data depending on whether the decrypted bytes have valid padding or merely fail to parse as JSON. An attacker can use that difference to decrypt the upload configuration and, using a technique TantoSec built around the control's fixed encryption seed, forge it without ever learning the encryption key. The forged configuration then lets the attacker name an arbitrary .NET type. Because the control resolves that type without an allowlist, the flaw CVE-2026-13181 carries a CVSS score of 8.1, which is in the high severity range. The resolved type deserializes into a gadget that loads a DLL from a location the attacker controls. That uploaded DLL is a mixed-mode assembly, meaning it contains both managed .NET code and native machine code, and it runs the native code as soon as it loads.

TantoSec's end-to-end demonstration took roughly 127,000 oracle requests, which took about an hour against a lab target and longer against a rate-limited server. If the application hides detailed error messages, the padding oracle can still be read through response timing, a variant tracked as CVE-2026-13183. The two released payloads show different goals: one writes a web shell to disk, and one runs entirely in memory. A web shell is a small file placed on a server that gives an attacker a backdoor control panel through a web browser. The in-memory version leaves no file behind in that location.

Progress has seen no confirmed reports of these 2026 flaws being exploited in the wild, and none appears in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of September 7. One attack-surface-management vendor, IONIX, states on its website that it is tracking ongoing exploitation attempts, but it gives no dates, volumes, or other specifics and does not distinguish exploitation from ordinary internet scanning of the handler. The component itself has a long history of real-world attacks, but through older bugs, not these. A 2019 deserialization flaw in the same handler, CVE-2019-18935, was chained with a 2017 encryption weakness and exploited by ransomware crews and nation-state actors, including in a 2022 breach of a U.S. federal agency, and was still being exploited as recently as 2025. That track record is why an unauthenticated code-execution path in this handler draws attention, even though the new bugs have no confirmed exploitation.

Progress's July bulletin actually covers two separate attack chains. The RadAsyncUpload chain TantoSec detailed is one. The other is a distinct remote-code-execution chain in the RadPersistenceManager and RadDockLayout components, tracked as CVE-2026-13185, CVE-2026-13186, and CVE-2026-13190, credited to CODE WHITE's Markus Wulftange and Progress. No public exploit has been released for that second chain. Within the RadAsyncUpload chain, a fourth bug involving a predictable default key, CVE-2026-13184, applies only to an alternative attack mode that the released demonstration did not use.

The primary fix is to upgrade to Telerik UI for ASP.NET AJAX 2026.2.708 (2026 Q2 SP1) or later, which replaces the flawed AES-CBC scheme with authenticated encryption and closes the entire chain. Progress calls upgrading its only official recommendation and warns that a stronger custom key does not help, because the oracle never needs the key. For sites that cannot upgrade immediately, Progress lists several interim steps. Setting customErrors to RemoteOnly or On forces an attacker onto the slower timing-based variant. Disabling the upload handler entirely by setting Telerik.Web.DisableAsyncUploadHandler to true is appropriate if RadAsyncUpload is not required. Removing any custom encryption key makes the control fall back to the ASP.NET machine key with AES and HMAC, or administrators can generate strong machine keys manually rather than at runtime.

Because successful exploitation does not leave obvious traces in standard ASP.NET error logs, defenders should hunt behaviorally rather than for error signatures. That means looking for the IIS worker process (w3wp.exe) spawning cmd.exe, a new or unexpected .aspx file in the web root, or a mixed-mode DLL written under the upload control's temporary folder or App_Data.

For organizations running older .NET web applications, a security-first IT and consulting partner such as AEU-I can help inventory affected Telerik controls and plan a safe upgrade, but the official Progress patch remains the only complete fix.

TantoSec reported the issues to Progress on May 22; the fix shipped on July 8, and the CVEs followed on July 22. Almeida credited colleague Justin Steven for the timing-oracle variant.