Telerik Padding-Oracle RCE: Public Exploit Raises the Stakes for ASP.NET Shops

As reported by The Hacker News, security researcher Marcio Almeida of TantoSec has published a fully functional exploit chain targeting Telerik UI for ASP.NET AJAX, converting an AES-CBC padding oracle vulnerability into unauthenticated remote code execution. The tooling — including a command-line exploit and two DLL payloads — is now publicly available, compressed into a ready-to-run package.

What makes this disclosure particularly noteworthy is not the novelty of the technique — padding oracle attacks have been well-documented since Vaudenay's 2002 research — but the convergence of three factors: a widely deployed enterprise component, a complete public attack chain, and a configuration dependency that ironically stems from a vendor-recommended hardening practice.

Vulnerability Summary

Affected Products and Versions

Why This Matters Beyond the CVE Numbers

The most critical insight from this disclosure is the configuration paradox. The exploit chain only works when two non-default conditions are met: a page renders the RadAsyncUpload control with server-side upload result processing, and the application uses an explicit, non-default encryption key. That second condition is particularly insidious because Telerik's own documentation has historically recommended setting an explicit encryption key as a hardening measure — meaning security-conscious teams may have inadvertently placed themselves in the exploitable population.

This is a recurring pattern in enterprise software security: hardening guidance that becomes the attack vector. Defenders who followed vendor best practices are now the most exposed, and those who left default configurations in place may actually be safer. This inversion of the expected risk model should prompt every organization running Telerik UI to audit not just their version but their configuration posture — something traditional vulnerability scanners frequently miss.

The two-month gap between Progress's July patch and September's public exploit release represents the real danger window. Organizations that delayed patching — perhaps because the CVSS 8.1 rating fell below their critical threshold, or because the non-default configuration caveat created a false sense of security — now face active risk as the exploit tooling circulates.

Broader Implications

Telerik UI for ASP.NET AJAX has a notable history of security issues. This chain follows prior vulnerabilities in the same product family, suggesting that the RadAsyncUpload control's architecture — which necessarily handles file uploads, encryption, and deserialization — continues to be a productive attack surface. The padding oracle component (CVE-2026-13182) highlights a persistent failure mode: the use of AES-CBC without an integrity mechanism like HMAC or the migration to authenticated encryption (AES-GCM). This is a textbook cryptographic anti-pattern that continues to appear in production enterprise software nearly 25 years after it was first described.

For ransomware operators and initial access brokers, public exploit tooling paired with a widely deployed enterprise component is an attractive combination. ASP.NET applications are common in healthcare, finance, and government sectors — industries that run legacy web frameworks and frequently have slower patch cycles. The IIS application pool execution context means successful exploitation grants a foothold on the web server, which can be leveraged for lateral movement or data exfiltration.

The lesson here is structural: vulnerability management programs that prioritize CVSS scores without accounting for configuration context and exploit availability will systematically misjudge risk. A High-severity bug with public tooling in a specific but identifiable configuration is more urgent than many Critical-severity bugs with no practical attack path.

Shield53 Recommendations

Immediate Actions

• Inventory and patch: Identify all ASP.NET applications using Telerik UI for ASP.NET AJAX. Upgrade to version 2026.2.708 or later immediately. Versions spanning 16 years (2010–2026) are affected — assume broad exposure across legacy application portfolios.
• Audit configurations: Even on patched versions, review RadAsyncUpload encryption key settings. Document which applications use explicit (non-default) keys, as these were the exploitable subset. Verify that patched versions enforce integrity checks on encrypted state.
• Network-level mitigations: If patching cannot be completed immediately, restrict external access to pages rendering RadAsyncUpload controls. Implement WAF rules to detect anomalous POST requests to Telerik handler endpoints (.axd) with unusual encrypted parameter lengths or patterns consistent with padding oracle probing.
• Detection guidance: Monitor IIS logs for repeated requests to RadAsyncUpload handler endpoints with varying ciphertext lengths — a signature of padding oracle byte-by-byte decryption attempts. Alert on unexpected DLL loading or file writes within IIS application pool working directories. Check for web shell artifacts in web-accessible directories following the attack pattern described in the released payloads.
• Configuration hardening review: Reassess all vendor hardening recommendations for Telerik controls in light of this disclosure. Engage with Progress's advisory documentation to understand whether the encryption key guidance has been updated.

Who Is Most at Risk

• Organizations running affected Telerik UI versions (2010.1.309 – 2026.2.519) with RadAsyncUpload controls exposed to unauthenticated users
• Applications configured with explicit, non-default encryption keys for RadAsyncUpload — particularly those deployed in healthcare, financial services, and public sector environments where ASP.NET frameworks are prevalent
• Teams with slow patch cadencies or those who deprioritized the July advisory due to the non-default configuration caveat

The release of working exploit code transforms this from a theoretical advisory concern into an operational threat. Treat it accordingly.