Security researchers have identified a dangerous chain of vulnerabilities in Telerik UI for ASP.NET AJAX that permits unauthenticated attackers to achieve remote code execution (RCE) in enterprise web applications. The flaw centers on Telerik’s RadAsyncUpload file-upload component, a common feature in ASP.NET WebForms setups.
This exploit impacts Telerik versions from 2010.1.309 through 2026.2.519, and was addressed by Progress Software in version 2026.2.708, released as part of the 2026 Q2 SP1 update. Enterprises still using earlier versions remain exposed. The threat arises from four distinct flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. Not every deployment is vulnerable under default settings, but certain configurations are at higher risk.
From Padding Oracle to File Upload Attack
The linchpin vulnerability is CVE-2026-13182, a padding oracle bug in how RadAsyncUpload handles encrypted client state. Telerik protects configuration data sent between server and browser using AES-CBC encryption. When the encrypted data is malformed, the system produces a different error than when the padding is valid but the JSON content inside is invalid—a discrepancy attackers can exploit. By submitting modified ciphertext repeatedly and observing responses, attackers can eventually recover sensitive data and forge encrypted messages without possessing the encryption key.
Leveraging that oracle, attackers can tamper with Telerik’s serializedConfiguration field, controlling properties like AllowedFileExtensions. By doing so, they may allow uploads of DLL files, bypassing what should be strict extension validation. A CBC forgery trick involving a “sacrificial” encrypted block inserted within JSON has been used to preserve legitimate configuration data while smuggling in malicious inputs.
Deserialization and RCE: CVE-2026-13181
Another critical gap—CVE-2026-13181—concerns how Telerik resolves type names sent via its AsyncUploadTypeName value. Without an allowlist, type names provided by a user can be resolved directly. If the server-side FileUploaded event handler reads the UploadResult property, attackers may exploit this by deserializing crafted data into a dangerous .NET type, notably using System.Configuration.Install.AssemblyInstaller. This facilitates loading a mixed-mode DLL from the server’s temp directory and executing native code via its DllMain entry point.
Proof-of-concepts have demonstrated full web shells running in the IIS worker process, as well as disk-free, in-memory command execution. These exploit steps require an active FileUploaded handler that uses UploadResult, and a non-default Telerik.AsyncUpload.ConfigurationEncryptionKey configured. Despite Telerik recommending a custom encryption key, many setups still use default or no key, increasing risk.
Mitigation & Recommendations
Organizations using Telerik UI for ASP.NET AJAX are strongly advised to update to version 2026.2.708 or newer. Administrators should audit web pages employing RadAsyncUpload, checking whether there are server-side FileUploaded handlers reading UploadResult. Also critical is verifying whether the configuration encryption key is explicitly set to avoid default behavior.
In addition, security teams should monitor for signs of exploitation: unexpected spawning of cmd.exe by w3wp.exe, unusually large or strange DLLs showing up in temp directories, or ASPX files unexpectedly appearing in webroot folders. Such indicators often signal that an attacker has taken advantage of file upload and deserialization flaws.
While default Telerik deployments without the necessary configuration may not fully expose these flaws, the threshold for compromise is lower than many realize—a combination of the padding oracle vulnerability and unsafe deserialization creates a steeper attack surface across numerous enterprise environments.
What this means is clear: this isn’t a narrow, isolated security issue. It’s a multi-step breach opportunity that affects any organization relying on Telerik’s RadAsyncUpload with legacy versions and non-default settings. The value of prompt patching, dependency management, and configuration audits can’t be overstated. As threat actors often chain together multiple small vulnerabilities, defenders should assume these paths exist and plan accordingly.
