Unauthenticated RCE in Telerik UI for ASP.NET AJAX

Tanto Security has disclosed a critical unauthenticated Remote Code Execution (RCE) chain affecting Telerik UI for ASP.NET AJAX (versions 2010.1.309 through 2026.2.519). The attack leverages a padding oracle in the RadAsyncUpload control to decrypt and forge server-side configuration blobs. By tampering with these blobs, attackers can exploit an unguarded type-resolution flaw to load malicious mixed-mode DLLs into the IIS worker process.

While the vulnerability requires a specific non-default configuration—including an explicit encryption key and a page that reads the upload result—the impact is high as it grants full control over the web server. Progress Software released patches in July 2026 (version 2026.2.708) replacing the vulnerable AES-CBC scheme with authenticated AES-GCM. Although no confirmed in-the-wild exploitation has been recorded for these specific 2026 CVEs, the targeted component has a long history of being abused by ransomware crews and nation-state actors.

Organizations using Telerik UI must prioritize upgrading to version 2026.2.708. If immediate patching is not possible, mitigations include disabling the AsyncUpload handler or ensuring customErrors are enabled to increase attack complexity by forcing the use of timing-based oracles.