Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE

A Cryptographic Oracle Becomes an RCE Chain

Security firm TantoSec has published a public proof-of-concept that chains a classic AES-CBC padding-oracle weakness in Telerik UI for ASP.NET AJAX into full unauthenticated remote code execution. The chain, disclosed responsibly to vendor Progress Software earlier this year, spans four related CVEs and demonstrates how a decades-old cryptographic bug class can still lead to complete server compromise when paired with an unsafe deserializer.

The CVEs

How the Exploit Chain Works

Exploitation requires two conditions that, while not the default configuration, are common enough in real deployments:

1. A page renders RadAsyncUpload with a server-side result handler.
2. The application uses a non-default, explicit encryption key.

Once those conditions are met, the attack proceeds in stages:

1. Attacker abuses the padding oracle in RadAsyncUpload's encryption
   to decrypt the upload configuration blob — without ever knowing
   the encryption key
2. Attacker forges a malicious configuration specifying an arbitrary
   .NET type
3. Telerik's unguarded deserializer loads and executes a mixed-mode
   DLL from an attacker-controlled location
4. Code executes with IIS application pool privileges

Researchers Marcio Almeida and Justin Steven of TantoSec reported the issues to Progress on May 22, 2026. Progress shipped fixes on July 8 and published the CVEs on July 22 — but TantoSec's exploit tooling only went public on September 7, meaning defenders have had roughly seven weeks to patch before working exploit code became widely available.

Affected Versions

Mitigation

Progress recommends upgrading immediately to 2026.2.708 or later. For organizations that can't patch right away:

1. Set customErrors to RemoteOnly or On — this blocks the faster, error-message-based variant of the padding oracle.
2. Disable RadAsyncUpload entirely if the application doesn't need it.
3. Remove custom encryption keys where possible, restoring protection under the standard ASP.NET machine key.
4. Monitor IIS application pool processes for unexpected child processes or unmanaged DLL loads following upload requests.

Given that public exploit tooling now exists, internet-facing Telerik deployments still running affected versions should be treated as an urgent patching priority.

References

• The Hacker News — Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE

Related Reading

• Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+