Telerik UI RCE Chain: PoC Published, Patch Is Out

Public exploit is live. TantoSec published a working proof-of-concept on September 7 chaining seven vulnerabilities in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. No exploitation in the wild confirmed as of this report.

The patch was released July 8, 2026. Progress Software issued its advisory July 22. The TantoSec PoC published September 7: ten weeks after the fix was available.

The chain

TantoSec researchers Marcio Almeida and Justin Steven published a working exploit covering seven CVEs: CVE-2026-13181 through CVE-2026-13186 and CVE-2026-13190.

The entry point is a padding oracle (CVE-2026-13182) in the RadAsyncUpload control’s AES-CBC encryption. An attacker who can reach a vulnerable upload endpoint decrypts the control’s encrypted configuration payload without knowing the key. The forged payload triggers unguarded type resolution (CVE-2026-13181), reaching arbitrary .NET type instantiation and code execution with IIS application pool privileges. CVSS: 8.1, High.

Configuration conditions

Exploitation requires all three: the application renders a RadAsyncUpload control, the control’s server-side handler reads the upload result, and an explicit non-default encryption key is configured. That last condition matters. Progress had previously recommended setting a custom encryption key as a hardening measure. Under this chain, that configuration is a prerequisite for the worst-case exploit path. Attack complexity is rated High because of these prerequisites.

Affected versions and patch

Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519 are affected. Fixed in 2026.2.708 (2026 Q2 SP1), released July 8, 2026. Progress Software’s advisory includes version guidance and interim mitigation options for applications that cannot update immediately.

Progress Software’s Kemp LoadMaster saw a similar disclosure pattern earlier this year: a public PoC arrived for pre-auth RCE weeks after the patch dropped. CrowdStrike Falcon also saw a privilege escalation PoC go public earlier this month.