TELERIK UI for ASP[.]NET AJAX has a padding-oracle chain that can lead to unauthenticated remote code execution (RCE) when using the RadAsyncUpload file-upload control. The public proof-of-concept by TantoSec demonstrates an end-to-end exploit chain that can run a DLL payload in a mixed-mode assembly, effectively giving an attacker code execution with the web server’s IIS application pool privileges.
Exploitation hinges on two conditions: the target application must render a RadAsyncUpload control whose server-side handler reads the upload result, and the site must be configured with an explicit non-default encryption key for the control. Progress Software patched the underlying flaws in July 2026 (version 2026.2.708, Q2 SP1) and issued CVEs and advisory on 22 July 2026.
The most critical flaw is CVE-2026-13181 (type-resolution) with a CVSS 8.1, and an accompanying padding-oracle flaw CVE-2026-13182 that enables decryption and forgery of the upload configuration (with potential timing-side variants CVE-2026-13183). The RadAsyncUpload chain affects versions 2010.1.309 through 2026.2.519; fixed in 2026.2.708 and later.
The article notes there are no confirmed in-the-wild exploits as of 7 September 2026, though IONIX and others are watching for exploitation attempts. If you cannot upgrade immediately, Progress recommends mitigating steps such as enabling RemoteOnly/On customErrors, disabling the upload handler via Telerik.Web[.]DisableAsyncUploadHandler, or removing non-default encryption keys so the control uses the ASP[.]NET machine key with AES and HMAC.
Defence should prioritise behavioural indicators—such as unexpected w3wp[.]exe activity, new .aspx files in web roots, or mixed-mode DLLs in upload temp folders—since successful exploitation can leave few logs.