CVE-2026-13181Disclosure(progress / telerik_ui_for_asp.net_ajax)

MEDIUMCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch progress telerik_ui_for_asp.net_ajax systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.

progress CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-asyncuploadtypename-deserialization-CVE-2026-13181

Weakness type (CWE)

CWE-470

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

telerik_ui_for_asp.net_ajax

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 2 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 5 signals
Technical details provided in 6 signals
Disclosure: 2 classified signals
Peaked 3d ago at 2 mentions (2026-09-07); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

progress

Products

telerik_ui_for_asp.net_ajax

Deep dive

Activity timeline6 mentions / 4d

Signal classification4 categories

Disclosure

233.3%

Exploit

233.3%

PoC

116.7%

Patch

116.7%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-07	2	Disclosure1Exploit1
2026-09-08	2	Disclosure1PoC1
2026-09-10	1	Exploit1
2026-09-15	1	Patch1

Full discourse6 posts

VulnTracker@vuln_tracker46d
Disclosure
One padding oracle. Four CVEs. Zero authentication required. Researchers uncovered a vulnerability chain in Telerik UI for http://ASP.NET AJAX (CVE-2026-13181, -13182, -13183, -13184) that lets unauthenticated attackers achieve remote code execution. The root cause: a padding oracle in RadAsyncUpload's encrypted client state lets attackers forge configuration data without ever knowing the encryption key — then abuse type resolution to upload and execute a malicious DLL. Affects: Telerik UI for http://ASP.NET AJAX 2010.1.309 through 2026.2.519 Fixed in: 2026.2.708 If you're running Telerik UI for http://ASP.NET AJAX, patch now. Details: http://vulntracker.io/cves/CVE-2026-13181 #Telerik #CVE #RCE #PaddingOracle #VulnTracker #AppSec
Post summary
Researchers disclosed a chain of four CVEs in Telerik UI for ASP.NET AJAX that allow unauthenticated remote code execution via a padding oracle; patching is recommended.
00052756
816 followersView on X
iototsecnews@iototsecnews39d
Patch
Telerik の脆弱性 CVE-2026-13181／13182／13183／13184 が FIX：AES-CBC パディング・オラクルの恐れ https://iototsecnews.jp/2026/09/07/telerik-ui-flaws-let-attackers-chain-aes-cbc-padding-oracle-to-unauthenticated-rce/ Progress Telerik UI for http://ASP.NET AJAX において、複数の重大な不具合が判明しました。対象は CVE-2026-13181／CVE-2026-13182／CVE-2026-13183／CVE-2026-13184 です。暗号処理の不備による情報漏洩／設定値の改ざん／不正なファイルのアップロード／不審な処理の実行といった多段階の攻撃に悪用される恐れがあります。遠隔の第三者により、システム上で意図しないコードが実行され、制御権を奪われる危険性があります。安全な運用に向けて、開発元が配信する修正済みバージョン 2026.2.708 以降への速やかな更新／公開中のコンポーネントの設定見直し／不審なファイルの監視が求められます。#CVE202613181 #CVE202613182 #CVE202613183 #CVE202613184 #Telerik #Vulnerability
Post summary
The text reports multiple Telerik UI vulnerabilities involving AES-CBC padding oracle risks that may lead to remote code execution. Its primary actionable takeaway is to update to fixed version 2026.2.708 or later and apply related hardening measures.
00000131
513 followersView on X
BT Haberler@BTHaberler43d
Exploit
Telerik UI'daki Padding Oracle Açığı, Kimlik Doğrulaması Olmadan Uzaktan Kod Çalıştırmaya Zincirlenebiliyor; Kanıt Kodu Yayınlandı! TantoSec araştırmacıları, Telerik UI for http://ASP.NET AJAX'taki bir AES-CBC "padding oracle" açığı (CVE-2026-13182) ile bir tür çözümleme açığını (CVE-2026-13181, CVSS 8.1) zincirleyen ve kimlik doğrulaması olmadan uzaktan kod çalıştırmaya yol açan çalışan bir istismar kodunu kamuya açıkladı. • Saldırı, şifreli durum verisini çözmek için yaklaşık 127.000 "oracle" isteği gönderilmesini gerektiriyor; laboratuvar ortamında bu süreç yaklaşık bir saat sürüyor. Başarılı olduğunda saldırgan, kontrolündeki bir DLL dosyasının yüklenmesini sağlayarak kod çalıştırabiliyor. • Progress Software açığı 8 Temmuz'da yamalamıştı; kullanıcıların Telerik UI'ı 2026.2.708 veya üstü sürüme güncellemesi gerekiyor. Bir kriptografik "padding oracle" zafiyetinin, binlerce otomatik istekle sabırla istismar edilip tam bir uzaktan kod çalıştırma zincirine dönüştürülebilmesi, görünüşte yavaş ve karmaşık kriptografik saldırıların bile pratikte ciddi bir tehdit oluşturabildiğini gösteriyor. #SiberGüvenlik #Telerik #RCE
Post summary
TantoSec researchers released a functional exploit chain for Telerik UI’s padding‑oracle vulnerabilities, detailing attack steps and the need to patch to 2026.2.708 or higher; no evidence of active in‑the‑wild exploitation is present.
0000050
41 followersView on X
Techsico IT@Techsico_IT45d
PoC
https://ASP.NET admins: a public PoC targets the Telerik RadAsyncUpload chain (CVE-2026-13181/13182). No confirmed wild exploitation: but patch now: upgrade to 2026.2.708+ or disable the handler if unused. https://t.co/9y09gagKHK
Post summary
A public PoC targeting the Telerik RadAsyncUpload chain (CVE‑2026‑13181/13182) was disclosed, with no confirmed wild exploitation. A patch is available: upgrade to 2026.2.708+ or disable the handler if unused.
0000038
9 followersView on X
Xavier Rivera@XavierRiveraX46d
Exploit
TantoSec published a working exploit chain for Telerik UI's RadAsyncUpload control: an AES-CBC padding oracle (CVE-2026-13182) chained with an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1) for unauthenticated RCE. Progress patched it in July; the chain only works if the app sets a non-default custom encryption key. No confirmed in-the-wild exploitation.
Post summary
TantoSec disclosed a working exploit chain that chains an AES-CBC padding oracle (CVE-2026-13182) with an unguarded type‑resolution flaw (CVE-2026-13181) to achieve unauthenticated RCE in Telerik UI, and Progress issued a patch in July; no in‑the‑wild attacks have been confirmed.
0000096
605 followersView on X
NewNormal Security@NewScanTeam46d
Disclosure
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 7 Sep 2026 𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan: 🔓 IP allow-list bypass via a spoofed X-Forwarded-For — reaches the admin pages the IP check was the only thing guarding (PrestaShop CVE-2026-84186) 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Deserialization RCE in an http://ASP.NET file-upload control — unauthenticated code execution on the web server (Progress Telerik CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184, CVE-2026-13185, CVE-2026-13186, CVE-2026-13190) 📦 Stored XSS in a WordPress plugin's lazy-load image parser — script that runs for every later visitor to the page (Powerkit CVE-2026-2390) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #Deserialization #CSO #REDTEAM
Post summary
The post serves as a daily disclosure of newly detected CVEs, describing their technical details (e.g., deserialization RCE, XSS, IP allow-list bypass) and linking to the vendor’s detection tool.
0000060
7 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	progress	telerik_ui_for_asp.net_ajax	-	-	-

Explore more

Back to dashboard progress CVEs telerik_ui_for_asp.net_ajax vulnerabilities

What researchers are saying

CVE-2026-13181

VulnTracker[verified]@vuln_trackerDisclosure

Researchers disclosed a chain of four CVEs in Telerik UI for ASP.NET AJAX that allow unauthenticated remote code execution via a padding oracle; patching is recommended.

BT Haberler[verified]@BTHaberlerExploit

TantoSec researchers released a functional exploit chain for Telerik UI’s padding‑oracle vulnerabilities, detailing attack steps and the need to patch to 2026.2.708 or higher; no evidence of active in‑the‑wild exploitation is present.

Xavier Rivera[verified]@XavierRiveraXExploit

TantoSec disclosed a working exploit chain that chains an AES-CBC padding oracle (CVE-2026-13182) with an unguarded type‑resolution flaw (CVE-2026-13181) to achieve unauthenticated RCE in Telerik UI, and Progress issued a patch in July; no in‑the‑wild attacks have been confirmed.

NewNormal Security[verified]@NewScanTeamDisclosure

The post serves as a daily disclosure of newly detected CVEs, describing their technical details (e.g., deserialization RCE, XSS, IP allow-list bypass) and linking to the vendor’s detection tool.

iototsecnews@iototsecnewsPatch

The text reports multiple Telerik UI vulnerabilities involving AES-CBC padding oracle risks that may lead to remote code execution. Its primary actionable takeaway is to update to fixed version 2026.2.708 or later and apply related hardening measures.

Techsico IT@Techsico_ITPoC

A public PoC targeting the Telerik RadAsyncUpload chain (CVE‑2026‑13181/13182) was disclosed, with no confirmed wild exploitation. A patch is available: upgrade to 2026.2.708+ or disable the handler if unused.