Telerik UI: Public RCE Exploit Turns Encryption Key Into a Weapon

TantoSec released a full exploit chain for Telerik UI for ASP.NET AJAX. The explicit encryption key, recommended as a hardening measure, is the prerequisite for the attack.

On September 7, 2026, TantoSec published a complete exploit chain that turns a cryptographic padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. The release drastically lowers the barrier to attack, but it hides a paradox: the exploit works only against the most diligent organizations — those that followed the vendor's hardening recommendations by explicitly configuring a custom encryption key. Progress Software had already patched the vulnerability on July 8, 2026, four weeks before the CVE publication and nearly two months before the public exploit.

Key Takeaways

TantoSec released the telerik-rau-exploit tool with a mixed-mode DLL payload for on-disk and in-memory web shells
The chain exploits CVE-2026-13182 (AES-CBC padding oracle) and CVE-2026-13181 (unguarded type resolution, CVSS 8.1) for unauthenticated RCE
The decisive prerequisite is the explicit encryption key Telerik.AsyncUpload.ConfigurationEncryptionKey, recommended by Telerik as a security measure
Progress Software patched the vulnerability in version 2026.2.708 released July 8, 2026; affected versions range from 2010.1.309 to 2026.2.519

How the Attack Works: From Padding Oracle to Shell

The core of the chain is a padding oracle in AES-CBC without an integrity mechanism in the upload configuration handling. As documented by TantoSec and reported by The Hacker News, the server responds distinguishably to valid versus invalid padding, enabling byte-by-byte decryption. When customErrors is enabled — a common production configuration — the discriminator becomes temporal: CVE-2026-13183 turns the timing difference into a functional oracle.

The attacker forces the upload configuration to bypass allowed file type restrictions. The lack of an allowlist in .NET type resolution then allows controlled deserialization. According to GBHackers, the gadget used is System.Configuration.Install.AssemblyInstaller with an attacker-controlled Path: the mixed-mode C++/CLI DLL is loaded and the native code in DllMain executes before any managed execution occurs. The payload can operate as a persistent on-disk web shell or remain entirely in-memory.

The cryptographic forgery employs a specific technique: a "sacrificial block" to insert forged data inside a UTF-16LE-encoded JSON payload. The entire process requires approximately 127,000 oracle requests, with an estimated time of about one hour under lab conditions.

The Hardening Paradox: Those Who Protected Themselves Are More Exposed

The vulnerable configuration is not the default. According to TantoSec, cited by The Hacker News, the chain has "preconditions that are not met by a default installation." Three concurrent elements are required: a page with the RadAsyncUpload component, a server-side handler that reads the UploadResult property, and — the decisive element — the explicit encryption key Telerik.AsyncUpload.ConfigurationEncryptionKey configured to a non-default value.

This last requirement is the heart of the paradox. The custom key is a hardening recommendation documented by Telerik: organizations that implemented it to strengthen security have become privileged targets. Progress Software explicitly warned that "a stronger custom key does not help, because the oracle never needs the key": the vulnerability lies in how the padding is validated, not in the secrecy of the cryptographic material.

"A TantoSec proof-of-concept turns an AES-CBC 'padding oracle' in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July." — The Hacker News

Timeline and Historical Context: A Component Under Fire for Years

TantoSec's report to Progress Software dates to May 22, 2026. The vendor released the patch on July 8, 2026 in version 2026.2.708 (2026 Q2 SP1), replacing AES-CBC with authenticated encryption. The CVEs were published on July 22, 2026. The public exploit arrived on September 7, 2026, roughly six weeks after coordinated disclosure.

The RadAsyncUpload component is no stranger to attacks. CVE-2019-18935, with a CVSS 9.8 Critical rating, was actively exploited by ransomware operators and groups attributed to state-sponsored threats. The previous history makes the new chain particularly sensitive: infrastructures that did not update promptly in July 2026 now face a complete, verified public exploit in a component already known to attackers for its profitability.

Marcio Almeida of TantoSec acknowledged Justin Steven's contribution for the timing-oracle variant. The research, as reported on the TantoSec blog, was conducted "with some AI assistance, and a lot of old-fashioned human persistence."

Traces and Detection: An Attack That Evades Standard Logs

Progress Software warned that "successful exploitation leaves no obvious trace in standard ASP.NET error logs." The absence of obvious artifacts in conventional logs complicates post-compromise detection and demands behavioral hunting approaches: analysis of repeated request sequences against upload endpoints, monitoring for unexpected DLL loads, and correlation of anomalous timing in server responses.

No confirmations of in-the-wild exploitation of CVE-2026-13181, CVE-2026-13182, and CVE-2026-13183 have emerged as of September 7, 2026. IONIX stated it is tracking "ongoing exploitation attempts" but provided no verifiable details.

What to Do Now

Organizations using Telerik UI for ASP.NET AJAX must immediately verify the version in use. The affected range is 2010.1.309 through 2026.2.519: anyone in this interval who has configured Telerik.AsyncUpload.ConfigurationEncryptionKey with an explicit value is potentially vulnerable.

Upgrading to version 2026.2.708 or later is Progress Software's only official recommendation. The vendor replaced AES-CBC with authenticated encryption, eliminating the padding oracle attack surface. It is neither necessary nor useful to change the existing encryption key: the oracle does not depend on the secrecy of the cryptographic material.

For infrastructures where immediate upgrade is not feasible, configuration control is essential. Verify whether pages exist with RadAsyncUpload where the server-side handler reads UploadResult and whether customErrors is set to On, a condition that enables the timing-oracle variant.

Detection must focus on behavioral patterns: sequences of approximately 127,000 requests against upload endpoints, unexpected DLL file loads, and timing anomalies in server responses. Security teams must assume that public exploits for components with a history of active exploitation — like RadAsyncUpload — will be rapidly adopted by threat actors.

Editorial Close

The TantoSec chain represents a rare case study: a hardening measure becomes a prerequisite for attack. The paradox does not invalidate security recommendations, but it demonstrates that their implementation must be accompanied by continuous updating. Progress Software patched promptly; the exposure window now depends exclusively on the patching speed of organizations. With CVE-2019-18935 already in the history of active exploits, the margin for inaction is zero.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter