Telerik UI exploit chain enables unauthenticated RCE on ASP.NET apps — public PoC now released

Security firm TantoSec published on September 7 a working exploit chain targeting Telerik UI for ASP.NET AJAX that allows an unauthenticated attacker to execute arbitrary code on any server running a vulnerable version. The release pairs a detailed technical write-up with a ready-to-run command-line tool called telerik-rau-exploit and two payloads — one that drops a web shell to disk, another that runs entirely in memory — putting a complete attack path in public hands for the first time.

The chain links four distinct vulnerabilities: CVE-2026-13181 (unguarded type-resolution, CVSS 8.1), CVE-2026-13182 (AES-CBC padding oracle), CVE-2026-13183 (timing-based oracle variant), and CVE-2026-13184 (predictable default encryption key). Researcher Marcio Almeida found that combining the padding oracle with the predictable key material and a type-name deserialisation gadget is sufficient to escalate from "can decrypt server-side data" to "can run code as the IIS application pool." A separate set of three additional CVEs (CVE-2026-13185, -13186, -13190) covers a parallel RCE path documented in the same write-up.

The affected range spans versions 2010.1.309 through 2026.2.519 — a window stretching across 16 years of Telerik releases. Progress Software patched all flaws in version 2026.2.708, released as part of the 2026 Q2 SP1 update on July 8, and organizations that applied that update are protected. As of publication, no confirmed in-the-wild exploitation of the 2026 CVEs has been reported, though Telerik components have historically attracted active exploitation quickly once public exploits appear.

There is one significant precondition: the attack requires the application to be configured with an explicit, non-default encryption key for the RadAsyncUpload control. In a default installation, no such key is set, which ironically provides some protection — though security teams should not rely on that default. Many large enterprise deployments set custom keys precisely to avoid well-known default-key exploits from prior Telerik CVEs, and those installations are now the more exposed ones.

Telerik UI for ASP.NET AJAX is embedded in a wide range of enterprise line-of-business applications, government portals, and healthcare systems. Organizations running any version from 2010 onward should upgrade to 2026.2.708 immediately. Where upgrading is not immediately possible, disabling or removing any page that renders a RadAsyncUpload control reduces the attack surface significantly.

The TantoSec disclosure follows a pattern of long-delayed public exploit releases for Telerik UI: the 2017 CVE-2017-11317 flaw was actively exploited by nation-state actors years before defences caught up. Security teams should treat any delay between patch availability and exploit publication as a warning window, not a safe harbour.

As first reported by The Hacker News, citing TantoSec research by Marcio Almeida published September 7, 2026.