VulnSocial

CVE-2026-13182Exploit(progress / telerik_ui_for_asp.net_ajax)

MEDIUMCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch progress telerik_ui_for_asp.net_ajax systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.

progress CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-209

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • telerik_ui_for_asp.net_ajax

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 3 signals
  • PoC mentioned or linked in 3 signals
  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 6 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 3 mentions (2026-09-07); latest day: 1
  • 6 total mentions across 4 days

Affected systems

Vendors
progress
Products
telerik_ui_for_asp.net_ajax

Deep dive

Activity timeline6 mentions / 4d
01223Mentions · 2026-09-07: 3Mentions · 2026-09-08: 1Mentions · 2026-09-10: 1Mentions · 2026-09-15: 1PoC Mentioned / Linked · 2026-09-07: 2PoC Mentioned / Linked · 2026-09-10: 1Exploit Tool / Code · 2026-09-07: 2Exploit Tool / Code · 2026-09-10: 1Patch / Workaround · 2026-09-07: 2Patch / Workaround · 2026-09-10: 1Patch / Workaround · 2026-09-15: 1Technical Details · 2026-09-07: 3Technical Details · 2026-09-08: 1Technical Details · 2026-09-10: 1Technical Details · 2026-09-15: 109-0709-0809-1009-15
Signal classification4 categories
Exploit
350.0%
General
116.7%
Disclosure
116.7%
Patch
116.7%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-09-073
Exploit2General1
2026-09-081
Disclosure1
2026-09-101
Exploit1
2026-09-151
Patch1
Full discourse6 posts
  • iototsecnews@iototsecnews
    Patch

    Telerik の脆弱性 CVE-2026-13181／13182／13183／13184 が FIX：AES-CBC パディング・オラクルの恐れ https://iototsecnews.jp/2026/09/07/telerik-ui-flaws-let-attackers-chain-aes-cbc-padding-oracle-to-unauthenticated-rce/ Progress Telerik UI for http://ASP.NET AJAX において、複数の重大な不具合が判明しました。対象は CVE-2026-13181／CVE-2026-13182／CVE-2026-13183／CVE-2026-13184 です。暗号処理の不備による情報漏洩／設定値の改ざん／不正なファイルのアップロード／不審な処理の実行といった多段階の攻撃に悪用される恐れがあります。遠隔の第三者により、システム上で意図しないコードが実行され、制御権を奪われる危険性があります。安全な運用に向けて、開発元が配信する修正済みバージョン 2026.2.708 以降への速やかな更新／公開中のコンポーネントの設定見直し／不審なファイルの監視が求められます。#CVE202613181 #CVE202613182 #CVE202613183 #CVE202613184 #Telerik #Vulnerability

    Post summary

    The post announces multiple CVEs in Progress Telerik UI and emphasizes the availability of a fixed version (2026.2.708) along with mitigation recommendations, making patch information the primary focus.

    00000131
    513 followersView on X
  • BT Haberler@BTHaberler
    Exploit

    Telerik UI'daki Padding Oracle Açığı, Kimlik Doğrulaması Olmadan Uzaktan Kod Çalıştırmaya Zincirlenebiliyor; Kanıt Kodu Yayınlandı! TantoSec araştırmacıları, Telerik UI for http://ASP.NET AJAX'taki bir AES-CBC "padding oracle" açığı (CVE-2026-13182) ile bir tür çözümleme açığını (CVE-2026-13181, CVSS 8.1) zincirleyen ve kimlik doğrulaması olmadan uzaktan kod çalıştırmaya yol açan çalışan bir istismar kodunu kamuya açıkladı. • Saldırı, şifreli durum verisini çözmek için yaklaşık 127.000 "oracle" isteği gönderilmesini gerektiriyor; laboratuvar ortamında bu süreç yaklaşık bir saat sürüyor. Başarılı olduğunda saldırgan, kontrolündeki bir DLL dosyasının yüklenmesini sağlayarak kod çalıştırabiliyor. • Progress Software açığı 8 Temmuz'da yamalamıştı; kullanıcıların Telerik UI'ı 2026.2.708 veya üstü sürüme güncellemesi gerekiyor. Bir kriptografik "padding oracle" zafiyetinin, binlerce otomatik istekle sabırla istismar edilip tam bir uzaktan kod çalıştırma zincirine dönüştürülebilmesi, görünüşte yavaş ve karmaşık kriptografik saldırıların bile pratikte ciddi bir tehdit oluşturabildiğini gösteriyor. #SiberGüvenlik #Telerik #RCE

    Post summary

    Researchers have released a functional exploit for the Telerik UI padding oracle (CVE‑2026‑13182) that allows unauthenticated remote code execution; the vendor patched the flaw on July 8 and users should upgrade to 2026.2.708 or newer.

    0000050
    41 followersView on X
  • T1erOne@tieroneforum
    Disclosure

    Цепочка эксплуатации Telerik UI for https://ASP.NET AJAX: от padding oracle до unauthenticated RCE (CVE-2026-13182) https://tier1.life/thread/580 https://tieronemkfevyizxcnt355agysp2iemvhon6iyclwrc7yuc7oszgzrid.onion/thread/580 #articles @marcioalm #PaddingOracle #RCE #Telerik

    Post summary

    The post announces a chain of exploitation for CVE‑2026‑13182, describing how a padding oracle can lead to an unauthenticated RCE, but does not provide PoC, exploit code, or patches.

    00000118
    317 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Exploit

    Telerik UI for https://ASP.NET AJAX: public PoC turns RadAsyncUpload padding oracle CVE-2026-13182 into unauth RCE. Upgrade to 2026.2.708+. Progress patched in July; exploit tool is out now. https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/

    Post summary

    A public PoC for Telerik UI's RadAsyncUpload padding oracle CVE‑2026‑13182 has led to the release of an unauthenticated RCE exploit tool, while the vendor has issued a patch (2026.2.708+) to mitigate the issue.

    00000109
    3.0K followersView on X
  • Xavier Rivera@XavierRiveraX
    Exploit

    TantoSec published a working exploit chain for Telerik UI's RadAsyncUpload control: an AES-CBC padding oracle (CVE-2026-13182) chained with an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1) for unauthenticated RCE. Progress patched it in July; the chain only works if the app sets a non-default custom encryption key. No confirmed in-the-wild exploitation.

    Post summary

    TantoSec disclosed a functional exploit chain linking two high-severity vulnerabilities in Telerik UI, but no in‑the‑wild exploitation has been reported, and a vendor patch was released in July.

    0000096
    605 followersView on X
  • NewNormal Security@NewScanTeam
    General

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 7 Sep 2026 𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan: 🔓 IP allow-list bypass via a spoofed X-Forwarded-For — reaches the admin pages the IP check was the only thing guarding (PrestaShop CVE-2026-84186) 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Deserialization RCE in an http://ASP.NET file-upload control — unauthenticated code execution on the web server (Progress Telerik CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184, CVE-2026-13185, CVE-2026-13186, CVE-2026-13190) 📦 Stored XSS in a WordPress plugin's lazy-load image parser — script that runs for every later visitor to the page (Powerkit CVE-2026-2390) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #Deserialization #CSO #REDTEAM

    Post summary

    The post announces NewNormal Security’s daily CVE detections, enumerating several specific vulnerabilities with brief technical details, but does not provide PoC, exploit code, patches, or evidence of the CVEs being actively exploited.

    0000060
    7 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appprogresstelerik_ui_for_asp.net_ajax---

Explore more

Back to dashboardprogress CVEstelerik_ui_for_asp.net_ajax vulnerabilities